thinkycx

Pwnable.kr Toddler's Bottle writeup

ihciah@gmail.com

It has been a long time since I finish(nearly) these problems...

1. fd

In linux, 0 is std_input, 1 is std_output, 2 is std_error_output.

We just need to send LETMEWIN to std_input and set fd to 0 which means (our input - 0x1234) == 0.

thinkycx

helllo world

thinkycx

#! /usr/bin/env python
# encoding:utf-8
import urllib2
import sys
from poster.encode import multipart_encode
from poster.streaminghttp import register_openers



def poc():

thinkycx

# https://github.com/superkojiman/vulnerabilities/blob/master/Easy-File-Sharing-Web-Server-6.8/exploit.py
# https://blog.techorganic.com/2014/05/14/from-fuzzing-to-0-day/
# edited by thinkycx  20160309

# Exploit Title: Easy File Sharing Web Server 6.8 stack buffer overflow
# Date: 10 May 2014
# Exploit Author: superkojiman - http://www.techorganic.com
# Vendor Homepage: http://www.efssoft.com
# Software Link: http://www.sharing-file.com/efssetup.exe
# Version: 6.8

thinkycx

# get password saved in chrome  
# pip install pypiwin32
# @lijiejie https://github.com/lijiejie/chromePass/blob/master/chromePass.py

import os, sys
import shutil
import sqlite3
import win32crypt

outFile_path = os.path.join(os.path.dirname(sys.executable),

thinkycx

import SimpleHTTPServer
import SocketServer
import socket  

hostname = socket.gethostname() 
ip = socket.gethostbyname(hostname) 
ipList = socket.gethostbyname_ex(hostname)

PORT = 8001

thinkycx

#!/bin/bash

# update apt-get
export DEBIAN_FRONTEND="noninteractive"
sudo apt-get update

# remove previously installed Docker
sudo apt-get remove docker docker-engine docker.io* lxc-docker*

# install dependencies 4 cert

thinkycx

#!/usr/bin/python

import sys
import struct
import hashlib
from zlib import adler32

def update_checksum(data):
    m = hashlib.sha1()
    m.update(data[32:])

thinkycx

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#ifdef _MSC_VER
#include <intrin.h> /* for rdtscp and clflush */
#pragma optimize("gt",on)
#else
#include <x86intrin.h> /* for rdtscp and clflush */
#endif

thinkycx

#!/bin/bash
# author: thinkycx
# sudo ln -s ~/bupt-gateway.sh /usr/bin/bupt-gateway && source ~/.zshrc
user=XXX
password=XXX
URL="http://10.3.8.211"
HTTP_CODE=$(curl -s -IL $URL | head -n 1 | grep -o 200)
CODE=200
if [ $HTTP_CODE -eq 200 ];then
    echo "Welcome to bupt!"