Created
April 28, 2018 13:47
-
-
Save habibiefaried/f9f581d51d7832c64c6359bcd3e204d9 to your computer and use it in GitHub Desktop.
Exploit generator from PEACH file
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/python | |
import sys | |
import binascii | |
''' | |
This python script will generate tcp/udp socket wrapper from PEACH crash binary | |
Always check this script's output! | |
Only works on single file PEACH crash binary | |
All printable characters will be printed out normally (instead of \\x) | |
''' | |
if (len(sys.argv) < 5): | |
print "Usage: ./exploitgen.py <IP Address> <PORT> <PEACH crash file> <TCP/UDP>" | |
sys.exit(0) | |
IP = str(sys.argv[1]) | |
PORT = int(sys.argv[2]) | |
FILE = str(sys.argv[3]) | |
connectstr = "s.connect((\""+IP+"\","+str(PORT)+"))" #for tcp | |
sendtostr = "s.sendto(data,(\""+IP+"\","+str(PORT)+"))" #for udp | |
def printTCPexp(payload): | |
m = ( | |
""" | |
print("Sending "+str(len(data))+" bytes data") | |
""") | |
exp = ( | |
""" | |
#!/usr/bin/python | |
import sys,socket | |
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM) | |
"""+connectstr+""" | |
data = \""""+payload+"\"\n\n"+m+""" | |
s.send(data) | |
""") | |
text_file = open(FILE+".py","w") | |
text_file.write(exp) | |
text_file.close() | |
print "Exploit over TCP file has been written to "+FILE+".py" | |
def printUDPexp(payload): | |
m = ( | |
""" | |
print("Sending "+str(len(data))+" bytes data") | |
""") | |
exp = ( | |
""" | |
#!/usr/bin/python | |
import sys,socket | |
s = socket.socket(socket.AF_INET,socket.SOCK_DGRAM) | |
data = \""""+ | |
payload+ | |
"""\"\n | |
""" | |
+m+"\n"+ | |
sendtostr+"\n") | |
text_file = open(FILE+".py","w") | |
text_file.write(exp) | |
text_file.close() | |
print "Exploit over UDP file has been written to "+FILE+".py" | |
data = "" | |
f = open(FILE, "rb") | |
byte = "." | |
try: | |
while byte != "": | |
# Do stuff with byte. | |
byte = f.read(1) | |
if (byte != ""): | |
bs = binascii.hexlify(byte) | |
intbs = int(bs,16) | |
#if ((intbs >= 32) and (intbs <= 126)): | |
#data = data + chr(intbs) | |
#else: | |
data = data + "\\x" + bs | |
finally: | |
f.close() | |
if (str(sys.argv[4]).lower() == "tcp"): | |
printTCPexp(data) | |
else: | |
printUDPexp(data) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment