Just connecting to the service, a 64bit cpu registers dump is received, and so does several binary code as you can see:
The registers represent an initial cpu state, and we have to reply with the registers result of the binary code execution. This must be automated becouse of the 10 seconds server socket timeout.
The exploit is quite simple, we have to set the cpu registers to this values, execute the code and get resulting registers.
In python we created two structures for the initial state and the ending state.
finalRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}
We inject at the beginning several movs for setting the initial state:
for r in cpuRegs.keys():
code.append('mov %s, %s' % (r, cpuRegs[r]))
The 64bit compilation of the movs and the binary code, but changing the last ret instruction by a sigtrap "int 3"
We compile with nasm in this way:
os.popen('nasm -f elf64 code.asm')
os.popen('ld -o code code.o ')
And use GDB to execute the code until the sigtrap, and then get the registers
fd = os.popen("gdb code -ex 'r' -ex 'i r' -ex 'quit'",'r')
for l in fd.readlines():
for x in finalRegs.keys():
...
We just parse the registers and send the to the server in the same format, and got the key.
The code:
from libcookie import *
from asm import *
import os
import sys
host = 'catwestern_631d7907670909fc4df2defc13f2057c.quals.shallweplayaga.me'
port = 9999
cpuRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}
finalRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}
fregs = 15
s = Sock(TCP)
s.timeout = 999
s.connect(host,port)
data = s.readUntil('bytes:')
#data = s.read(sz)
#data = s.readAll()
sz = 0
for r in data.split('\n'):
for rk in cpuRegs.keys():
if r.startswith(rk):
cpuRegs[rk] = r.split('=')[1]
if 'bytes' in r:
sz = int(r.split(' ')[3])
binary = data[-sz:]
code = []
print '[',binary,']'
print 'given size:',sz,'bin size:',len(binary)
print cpuRegs
for r in cpuRegs.keys():
code.append('mov %s, %s' % (r, cpuRegs[r]))
#print code
fd = open('code.asm','w')
fd.write('\n'.join(code)+'\n')
fd.close()
Capstone().dump('x86','64',binary,'code.asm')
print 'Compilando ...'
os.popen('nasm -f elf64 code.asm')
os.popen('ld -o code code.o ')
print 'Ejecutando ...'
fd = os.popen("gdb code -ex 'r' -ex 'i r' -ex 'quit'",'r')
for l in fd.readlines():
for x in finalRegs.keys():
if x in l:
l = l.replace('\t',' ')
try:
i = 12
spl = l.split(' ')
if spl[i] == '':
i+=1
print 'reg: ',x
finalRegs[x] = l.split(' ')[i].split('\t')[0]
except:
print 'err: '+l
fregs -= 1
if fregs == 0:
#print 'sending regs ...'
#print finalRegs
buff = []
for k in finalRegs.keys():
buff.append('%s=%s' % (k,finalRegs[k]))
print '\n'.join(buff)+'\n'
print s.readAll()
s.write('\n'.join(buff)+'\n\n\n')
print 'waiting flag ....'
print s.readAll()
print '----- yeah? -----'
s.close()
fd.close()
s.close()
- Hacker Techniques Tools And Incident Handling
- Hack Tools Mac
- Hack App
- Hacking Tools For Kali Linux
- Hacker Tools Linux
- Hacker Tools Free
- Pentest Tools Nmap
- Hacking Tools Mac
- Hak5 Tools
- Pentest Tools Subdomain
- Hacking Tools Github
- Hacking Tools Name
- Hack Tools 2019
- Hacker Tools For Windows
- Pentest Tools Download
- Hacker Tools Free Download
- Hack Tool Apk No Root
- Hacker Tools
- Hack Tool Apk No Root
- Hacking Tools For Mac
- Hacker
- Install Pentest Tools Ubuntu
- Hacking Tools For Beginners
- Pentest Tools Website
- Pentest Tools Linux
- Pentest Tools Kali Linux
- Hacker Tool Kit
- Hack And Tools
- Pentest Tools Apk
- Nsa Hacker Tools
- Hacker Tools 2019
- Physical Pentest Tools
- Computer Hacker
- Hacker Tools 2020
- Game Hacking
- Hacking Tools 2019
- Hacker Security Tools
- Android Hack Tools Github
- Hacker Tools Github
- Hack Tools For Games
- Pentest Tools Windows
- How To Install Pentest Tools In Ubuntu
- Hack Tools For Windows
- Hack Tool Apk No Root
- Hacking Tools Download
- Pentest Tools Kali Linux
- Tools Used For Hacking
- Hacking Tools For Windows 7
- Hacker
- Hack Tools Online
- Hacker Tools 2020
- Pentest Tools Free
- Pentest Tools Download
- Best Hacking Tools 2020
- Usb Pentest Tools
- Hacking Tools For Windows
- Black Hat Hacker Tools
- Hacking Tools Hardware
- Hacker Tools Online
- Tools 4 Hack
- Hack Tools For Ubuntu
- Pentest Tools Nmap
- Beginner Hacker Tools
- Hack Rom Tools
- Hacker Tools
- Hacking Tools Download
- Pentest Automation Tools
- Growth Hacker Tools
- Tools Used For Hacking
- Usb Pentest Tools
- New Hacker Tools
- Hack Tools For Windows
- Hacker Tools Software
- Pentest Tools Windows
- Pentest Tools Tcp Port Scanner
- Hacking Tools For Games
- Hack Tools For Pc
- Pentest Tools Subdomain
- Hacking Tools 2020
- Pentest Tools Linux
- Hacking Tools Online
- Pentest Tools Website
- Hacking Tools Online
- Hacker Tools Apk
- Hacking Tools Windows 10
- Best Pentesting Tools 2018
- Hack Tools For Mac
- Nsa Hack Tools
- Hacker Tools For Ios
- Wifi Hacker Tools For Windows
- Pentest Tools
- Hacking Tools For Mac
- Beginner Hacker Tools
- Growth Hacker Tools
- Pentest Tools Free
- Install Pentest Tools Ubuntu
- Hacker Tools Hardware
- Hacking Tools
- Wifi Hacker Tools For Windows
- Hacking Tools For Windows Free Download
- New Hacker Tools
- Hacking Tools Online
- Hackrf Tools
- Tools Used For Hacking
- Hacker Tools 2019
- Hacking Tools 2019
- Hacking Tools Name
- Pentest Tools Bluekeep
- Hack Tools For Mac
- Hacker Tools Free Download
- Hacking Tools Kit
- Bluetooth Hacking Tools Kali
- Hacks And Tools
- Hacking Tools And Software
- Hacker Tools List
- Pentest Tools Website
- Android Hack Tools Github
- Hack Tools Mac
- Pentest Tools Online
- Pentest Tools Online
- Hacker Tools Github
- Hacking Tools For Pc
- Pentest Tools Bluekeep
- Hacker Security Tools
- Hacker Tools Windows
- Hacking Tools 2020
- Hacker Tools For Mac
- Game Hacking
- Ethical Hacker Tools
- Pentest Recon Tools
- Pentest Box Tools Download
- Hacking Tools Github
- Pentest Recon Tools
- Nsa Hacker Tools
- Hacker Tools 2020
- Hacking Tools Online
- Hacking Apps
- Hacking Tools Hardware
- Hack Tools Online
- Pentest Tools For Ubuntu
- Hacking App
- Usb Pentest Tools
- Underground Hacker Sites
- Hackers Toolbox
- Hack Tool Apk
- Pentest Tools Android
- Hacking App
- Nsa Hack Tools
- Blackhat Hacker Tools
- Hacker Tool Kit
- Pentest Recon Tools
- Blackhat Hacker Tools
Nenhum comentário:
Postar um comentário