Skip to content

Instantly share code, notes, and snippets.

@mrT4ntr4
Created July 21, 2020 19:31
Show Gist options
  • Save mrT4ntr4/70bf14585625eb5e64d2b497af658cf0 to your computer and use it in GitHub Desktop.
Save mrT4ntr4/70bf14585625eb5e64d2b497af658cf0 to your computer and use it in GitHub Desktop.
My messy gdb python script for 999 Bottles challenge from RITSEC CTF 2019
#Writeup : https://ctftime.org/writeup/17193
flag = ""
i=1
for x in range(1,1000):
gdb.execute('set python print-stack full')
gdb.execute('set confirm off')
gdb.execute('file {:03}.c.out'.format(x))
gdb.execute('b *main')
gdb.execute('run < test')
gdb.execute('record')
gdb.execute('fin')
gdb.execute('reverse-step')
ret_addr = str(gdb.parse_and_eval('$eip')).split()[0]
cmp_addr = str(hex(int(ret_addr,16)-67))
print(ret_addr)
print("CMP : "+ cmp_addr)
gdb.execute('b *'+ cmp_addr)
gdb.execute('run < test')
gdb.execute('c')
flag += chr(int(str(gdb.parse_and_eval('$eax')),16))
print("FLAG : "+flag)
gdb.execute('del {}-{}'.format(i,i+1))
i+=2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment