Skip to content
Snippets Groups Projects
Commit dfd1be33 authored by Lukas Kotschi's avatar Lukas Kotschi :speech_balloon: Committed by dex
Browse files

Fixed bug, added functionality

parent 88b98432
No related branches found
No related tags found
1 merge request!1Fixed bug, added functionality
#!/usr/bin/env python #!/usr/bin/env python
import sys import sys
import os import os
from pwn import * from pwn import context, log, remote
from base64 import b64encode from base64 import b64encode
HOST = "10.0.23.24" HOST = "10.0.23.24"
...@@ -11,13 +11,17 @@ PORT = 31337 ...@@ -11,13 +11,17 @@ PORT = 31337
context.log_level = 'info' context.log_level = 'info'
#context.log_level = 'debug' #context.log_level = 'debug'
filename = "x"
remote_filename = "x"
is_executable = True
### SPLOIT ### ### SPLOIT ###
CHUNKSIZE = 64 CHUNKSIZE = 64
def connect(): def connect():
log.info(p.recvuntil("$ ")) log.info(p.recvuntil("$ "))
with open("./x", "rb") as f: with open(filename, "rb") as f:
data = f.read() data = f.read()
data = b64encode(data).decode() data = b64encode(data).decode()
...@@ -26,15 +30,28 @@ def connect(): ...@@ -26,15 +30,28 @@ def connect():
nchunks = ldata // CHUNKSIZE nchunks = ldata // CHUNKSIZE
rchunks = ldata % CHUNKSIZE rchunks = ldata % CHUNKSIZE
progress = log.progress("Transmitting {}".format(filename))
import IPython; IPython.embed() import IPython; IPython.embed()
assert nchunks * CHUNKSIZE + rchunks == ldata assert nchunks * CHUNKSIZE + rchunks == ldata
for idx in range(0,nchunks): for idx in range(0,nchunks):
p.sendline("echo -n \"{}\" >> x.b64".format(data[(idx*CHUNKSIZE):(idx+1)*CHUNKSIZE])) progress.status(str(idx * CHUNKSIZE) + " / " + str(ldata))
p.sendline("echo -n \"{}\" >> {}.b64".format(data[(idx*CHUNKSIZE):(idx+1)*CHUNKSIZE], remote_filename))
p.recvuntil("$ ")
if rchunks:
p.sendline("echo -n \"{}\" >> {}.b64".format(data[(-1)*rchunks:], remote_filename))
p.recvuntil("$ ") p.recvuntil("$ ")
p.sendline("echo -n \"{}\" >> x.b64".format(data[(-1)*rchunks:])) progress.success("Finished.")
p.sendline("cat {}.b64 | base64 -d > {}".format(remote_filename, remote_filename))
log.info(p.recvuntil("$ "))
if is_executable:
p.sendline("chmod +x {}".format(remote_filename))
log.info(p.recvuntil("$ "))
log.info("ldata: {}".format(ldata))
p.interactive() p.interactive()
return return
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment