WGH-

#!/usr/bin/env python2
# encoding: utf-8

import sys

import os
import codecs

import errno

WGH-

#!/usr/bin/env python3

import os
import sys
import subprocess
import tempfile

import contextlib

@contextlib.contextmanager

WGH-

#!/usr/bin/env python3
# encoding: utf-8

import sys

import os
import codecs

import errno

WGH-

The task is a remote x86_64 binary (both binary and libc were provided), and is marked with "pwn" and "network". So the goal is to exploit some vulnerability to obtain a shell.

They're actually two parts of the task, named 2manypkts-v1 and 2manypkts-v2 respectively.

The binary has somewhat trivial stack buffer overflow vulnerability. In the first part, you can just overflow the buffer up to (and beyond) main return address, and employ well-known ROP technique. The second part is harder: main never returns, but buffer can also overwrite some other variables, including several pointers to heap variables, which would allow to call realloc with arbitrary arguments.

WGH-

Keybase proof

I hereby claim:

• I am WGH- on github.
• I am wgh (https://keybase.io/wgh) on keybase.
• I have a public key whose fingerprint is 25DA BF19 C1BF 93A6 261C C136 B737 44F0 6687 E863

To claim this, I am signing this object:

WGH-

#!/usr/bin/python2

import sys

from pwn import *

def find_libc_path_and_offset():
    with open("/proc/self/maps") as f:
        for line in f:
            line = line.strip()

WGH-

#!/usr/bin/env python3

import sys
import pprint
import re
import subprocess

def get_mapping():
    p = subprocess.Popen(["xmodmap", "-pke"], stdout=subprocess.PIPE)

WGH-

package main

import (
	"bufio"
	"log"
	"os"

	"github.com/google/gopacket"
	"github.com/google/gopacket/layers"
	"github.com/google/gopacket/pcapgo"

WGH-

package main

import (
	"bufio"
	"log"
	"os"

	"github.com/google/gopacket"
	"github.com/google/gopacket/layers"
	"github.com/google/gopacket/pcapgo"

WGH-

package main

import (
	"bufio"
	"io/ioutil"
	"log"
	"os"
	"time"

	"github.com/google/gopacket"