exploit.py

from pwn import *
import argparse
import tempfile
import requests


def get_url():
    parser = argparse.ArgumentParser()
    parser.add_argument("url", help="The URL of the ELF file")
    args = parser.parse_args()
    return args.url


def fetch_file(url):
    # fetch the file
    response = requests.get(url)
    if response.status_code == 200:
        return response.content
    else:
        print("Failed to fetch the file!!!")
        print(f"Status code: {response.status_code}")
        exit(1)


def get_flag(url):
    # create a temporary file-like object from the ELF data
    with tempfile.NamedTemporaryFile(delete=False) as tmp_file:
        elf_data = fetch_file(url)
        tmp_file.write(elf_data)
        tmp_file.flush()
        tmp_file_path = tmp_file.name

    # load the ELF file
    elf = ELF(tmp_file_path)

    # disassemble the main function
    function_name = 'main'
    if function_name in elf.symbols:
        func_addr = elf.symbols[function_name]
        print("-"*50)
        print(f"Dissambly of the function '{function_name}':")
        disassembly = elf.disasm(func_addr, 64)
        print(disassembly)
        print("-"*50)

        for line in disassembly.split("\n"):
            if 'mov' in line and 'eax' in line:
                eax_value = [
                    val for val in line.split() if val.startswith('0x')]
                if eax_value:
                    hex2dec = int(eax_value[0], 16)
                    flag = f"picoCTF{{{hex2dec}}}"
                    break
    else:
        print(f"Function '{function_name}' not found in symbols.")

    # clean up the temporary file
    if os.path.exists(tmp_file_path):
        os.remove(tmp_file_path)

    return flag


if __name__ == "__main__":
    url = get_url()
    flag = get_flag(url)
    if flag:
        print(f"Flag: {flag}")
    else:
        print("Flag not found!!!\nMake sure the URL is correct!!!")