Skip to content

Instantly share code, notes, and snippets.

@AmunRha
Created April 27, 2021 21:10
Show Gist options
  • Save AmunRha/0c87663d5c8c859d32953475634b258b to your computer and use it in GitHub Desktop.
Save AmunRha/0c87663d5c8c859d32953475634b258b to your computer and use it in GitHub Desktop.
This is a solution for the challenge year3000 using gdb scripting
import gdb
import os
ins_32 = ['x/i 0x65E', 'x/i 0x665', 'x/wx 0x2008']
ins_64 = ['x/i 0x816', 'x/i 0x81D', 'x/gx 0x201010']
SIZE_32 = 5468
SIZE_64 = 6136
def parse(info):
n = info[0].split(',')[1].strip()
ch = info[1].split(',')[1].strip()
mem = info[2].split()[1].strip()
n, ch, mem = int(n, 0), int(ch, 0), int(mem, 0)
return n, ch, mem
def make_payload(n, ch, mem, fsz):
p = chr(ch)*n
if fsz == SIZE_32:
p = p.encode() + mem.to_bytes(4, 'little')
elif fsz == SIZE_64:
p = p.encode() + mem.to_bytes(8, 'little')
return p
def run_bin(payload, fname):
f = open('data', 'wb')
f.write(payload)
f.close()
print(f'[*] Executing payload for {fname}')
gdb.execute(f'shell cat data | ./{fname}')
print('\n')
def execute_ins(filename, filesize):
gdb.execute(f'file {filename}')
info = []
if filesize == SIZE_32:
for i in ins_32:
info.append(gdb.execute(i, to_string=True))
elif filesize == SIZE_64:
for i in ins_64:
info.append(gdb.execute(i, to_string=True))
n, char, memcmp = parse(info)
payload = make_payload(n, char, memcmp, filesize)
run_bin(payload, filename)
for i in range(1, 3001):
bin_file = str(i) + '.bin'
fsz = os.path.getsize(bin_file)
execute_ins(bin_file, fsz)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment