# engineOnline
Author: meh@HITCON  
### Description  ```we decide to make our engineTest online at 202.120.7.199:24680 (with command "./engineTest none none none none")you can get the binary from the attachment of challenge engineTest
libc.so.6```I cannot understand what this program is doing until my teammates Lucas and Lays solved the reverse part ... and still don't understand it clearly now.  Briefly, this program writes memory according to **ip** and print memory according to **op**, we didn't use cp so it is omitted.  And I got the read/write functions from my teammate Lucas. :P  
### Exploit  This program allows us to write everywhere **below** input memory, so we make it big enough to be mapped above libc section.  ```        +------------------+        |      binary      |        |------------------|        |  // big gap //   |        |------------------|        |   input memory   |        |------------------|        |       libs       |        |      & ld        |        |      & gaps      |        |      & tls       |        |------------------|        |       stack      |        |------------------|        |                  |        +------------------+```* Modify stderr with ip  We modify the content of stderr and partial overwrite the vtable, make it points to a fake vtable with gets_plt, so that we can use the libc address to rewrite the stderr after we leak.  * Leak with op  After ip, we use op to leak libc address.  * Exit and hijack control flow  When exit, the _dl_fini will call _IO_flush_all_lockp, which will call functions of stderr which is changed to gets.  * Rewrite stderr  We can rewrite the stderr with address we leaked, make the function pointer points to system.  * Get shell  Finally, it will call system(stderr), and we make the stderr start with '/bin/sh', so it will become system('/bin/sh').  