WGH-

The task is a remote x86_64 binary (both binary and libc were provided), and is marked with "pwn" and "network". So the goal is to exploit some vulnerability to obtain a shell.

They're actually two parts of the task, named 2manypkts-v1 and 2manypkts-v2 respectively.

The binary has somewhat trivial stack buffer overflow vulnerability. In the first part, you can just overflow the buffer up to (and beyond) main return address, and employ well-known ROP technique. The second part is harder: main never returns, but buffer can also overwrite some other variables, including several pointers to heap variables, which would allow to call realloc with arbitrary arguments.

WGH-

#!/usr/bin/env python3

import sys
import pprint
import re
import subprocess

def get_mapping():
    p = subprocess.Popen(["xmodmap", "-pke"], stdout=subprocess.PIPE)

WGH-

#!/usr/bin/env python3
# encoding: utf-8

import sys

import os
import codecs

import errno

WGH-

#!/usr/bin/python2

import sys

from pwn import *

def find_libc_path_and_offset():
    with open("/proc/self/maps") as f:
        for line in f:
            line = line.strip()

WGH-

#!/usr/bin/env python2
# encoding: utf-8

import sys

import os
import codecs

import errno

WGH-

#!/usr/bin/env python3

import os
import sys
import subprocess
import tempfile

import contextlib

@contextlib.contextmanager