[原创] pwnable.kr -- rest-of-toddler

终于结束了考试，刷题模式再次开启T^T

先来一道简单的题目热下身

toddler unlink

description

Daddy! how can I exploit unlink corruption?

ssh unlink@pwnable.kr -p2222 (pw: guest)

what it do

? ./unlink 

here is stack address leak: 0xffc28534

here is heap address leak: 0x82a0410

now that you have leaks, get shell!

a

Here we have a stack address, a heap address and an input
now the code

int __cdecl main(int argc, const char **argv, const char **envp)

{

  int *v3; // ST04_4

  char *heap1; // [esp-14h] [ebp-14h]

  _DWORD *heap3; // [esp-10h] [ebp-10h]

  _DWORD *heap2; // [esp-Ch] [ebp-Ch]

  malloc(0x400u);

  heap1 = (char *)malloc(0x10u);

  heap2 = malloc(0x10u);

  heap3 = malloc(0x10u);

  *(_DWORD *)heap1 = heap2;

  heap2[1] = heap1;

  *heap2 = heap3;

  heap3[1] = heap2;

  printf("here is stack address leak: %p\n", &heap1);

  printf("here is heap address leak: %p\n", heap1);

  puts("now that you have leaks, get shell!");

  gets(heap1 + 8);

  unlink((int)heap2, v3);

  return 0;

}

_DWORD *__cdecl unlink(int a1, int *a2)

{

  _DWORD *v2; // ST10_4

  int v3; // ST0C_4

  _DWORD *result; // eax

  v2 = (_DWORD *)a2[1];

  v3 = *a2;

  *(_DWORD *)(v3 + 4) = v2;

  result = v2;

  *v2 = v3;

  return result;

}

嘛，这可以算做一个 unlink 的入门练习吧，模仿unlink 的操作
you have three chunk, heap1, which you can overwrite. Heap2, av chunk which will be unlink.
So, 我们的目标就是通过改写 heap2 的 fd以及 bk 来控制执行流

0x804b408:      0x00000000      0x00000019      0x0804b428      0x00000000

0x804b418:      0x00000000      0x00000000      0x00000000      0x00000019

0x804b428:      0x0804b440      0x0804b410      0x00000000      0x00000000

0x804b438:      0x00000000      0x00000019      0x00000000      0x0804b428

0x804b448:      0x00000000      0x00000000      0x00000000      0x00000409

heap1 -- heap2 -- heap3

shell is given

0 0 0 举报 分享

分享到

微信

QQ

微博

复制链接

取消分享

微信扫码分享

关闭

复制成功