Cache Me Outside

cache_me_outside/Makefile

@@ -0,0 +1,5 @@
+all:
+	gcc -Xlinker -rpath=./ -Wall -m64 -pedantic -no-pie --std=gnu99 -o heapedit heapedit.c
+
+clean:
+	rm heapedit

cache_me_outside/cache_me_outside.rep/idata/00/00000000.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="Program" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="c0a8b2a0ecfb18259285716900" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="heapedit_patched" />
+    </BASIC_INFO>
+</FILE_INFO>

cache_me_outside/cache_me_outside.rep/idata/~index.bak

@@ -0,0 +1,5 @@
+VERSION=1
+/
+  00000000:heapedit_patched:c0a8b2a0ecfb18259285716900
+NEXT-ID:1
+MD5:d41d8cd98f00b204e9800998ecf8427e

cache_me_outside/cache_me_outside.rep/idata/~index.dat

@@ -0,0 +1,5 @@
+VERSION=1
+/
+  00000000:heapedit_patched:c0a8b2a0ecfb18259285716900
+NEXT-ID:1
+MD5:d41d8cd98f00b204e9800998ecf8427e

cache_me_outside/cache_me_outside.rep/project.prp

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="OWNER" TYPE="string" VALUE="MaximeVorwerk" />
+    </BASIC_INFO>
+</FILE_INFO>

cache_me_outside/cache_me_outside.rep/projectState

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<PROJECT>
+    <PROJECT_DATA_XML_NAME NAME="DISPLAY_DATA">
+        <SAVE_STATE>
+            <ARRAY NAME="EXPANDED_PATHS" TYPE="string">
+                <A VALUE="cache_me_outside:" />
+            </ARRAY>
+            <STATE NAME="SHOW_TABLE" TYPE="boolean" VALUE="false" />
+        </SAVE_STATE>
+    </PROJECT_DATA_XML_NAME>
+    <TOOL_MANAGER ACTIVE_WORKSPACE="Workspace">
+        <WORKSPACE NAME="Workspace" ACTIVE="true" />
+    </TOOL_MANAGER>
+</PROJECT>
+

cache_me_outside/cache_me_outside.rep/user/00/00000000.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="ProgramUserData" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="c0a8b2a0fa9225658685323700" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="udf_c0a8b2a0ecfb18259285716900" />
+    </BASIC_INFO>
+</FILE_INFO>

cache_me_outside/cache_me_outside.rep/user/~index.bak

@@ -0,0 +1,4 @@
+VERSION=1
+/
+NEXT-ID:0
+MD5:d41d8cd98f00b204e9800998ecf8427e

cache_me_outside/cache_me_outside.rep/user/~index.dat

@@ -0,0 +1,5 @@
+VERSION=1
+/
+  00000000:udf_c0a8b2a0ecfb18259285716900:c0a8b2a0fa9225658685323700
+NEXT-ID:1
+MD5:d41d8cd98f00b204e9800998ecf8427e

cache_me_outside/cache_me_outside.rep/user/~journal.bak

@@ -0,0 +1,2 @@
+IADD:00000000:/udf_c0a8b2a0ecfb18259285716900
+IDSET:/udf_c0a8b2a0ecfb18259285716900:c0a8b2a0fa9225658685323700

cache_me_outside/cache_me_outside.rep/versioned/~index.bak

@@ -0,0 +1,4 @@
+VERSION=1
+/
+NEXT-ID:0
+MD5:d41d8cd98f00b204e9800998ecf8427e

cache_me_outside/cache_me_outside.rep/versioned/~index.dat

@@ -0,0 +1,4 @@
+VERSION=1
+/
+NEXT-ID:0
+MD5:d41d8cd98f00b204e9800998ecf8427e

cache_me_outside/flag.txt

@@ -0,0 +1 @@
+testFLAG

cache_me_outside/sol.py

@@ -0,0 +1,31 @@
+#!/usr/bin/env python3
+
+from pwn import *
+
+exe = ELF("./heapedit_patched")
+libc = ELF("./libc.so.6")
+ld = ELF("./ld-2.27.so")
+
+context.binary = exe
+
+
+def conn():
+    if args.LOCAL:
+        r = process([exe.path])
+        if args.DEBUG:
+            gdb.attach(r)
+    else:
+        r = remote("addr", 1337)
+
+    return r
+
+
+def main():
+    r = conn()
+    r.recvuntil(b"Address: ")
+
+    r.interactive()
+
+
+if __name__ == "__main__":
+    main()