Sharon rev150 #29
Sharon rev150 #29
Conversation
RylanOC
left a comment
RylanOC
left a comment
There was a problem hiding this comment.
It looks like you accidentally pushed an mcore_... directory in exploit_generation_example. Aside from that, your script looks good to me!
|
|
bugsbunnyctf2017-rev150/solve.py
Outdated
| If our password passes all of the checks, we can return it as the flag. | ||
| """ | ||
| with m.locked_context() as context: | ||
| print("[+] success. flag: BugsBunny{" + str(context['password']) + "}") |
There was a problem hiding this comment.
It is more readable if we use proper string formatting instead of concatenating strings. In Python, there are three ways for that currently:
%operator for string, e.g.:'some int: %d' % some_int- note, that if you want to format more than one thing you need to pass a collection e.g.'some int: %d and string: %s' % (some_int, some_str)str.formatmethod e.g.:'some int: {} some str: {}'.format(some_int, some_str)- f-strings:
f'some int: {some_int} some str: {some_str}'
The % operator and .format methods are old ways to format strings. You can learn more about them on https://pyformat.info/. The f-string is a Literal String Interpolation added to Python 3.6 proposed in PEP-498.
I'd go for changing it to f-strings since we use them in Manticore anyway (and so we require Python>=3.6):
| print("[+] success. flag: BugsBunny{" + str(context['password']) + "}") | |
| print(f"[+] success. flag: BugsBunny{{context['password']}}") |
PS: It is possible to accept this change on github PR page.
bugsbunnyctf2017-rev150/solve.py
Outdated
| """ | ||
| with m.locked_context() as context: | ||
| print("[+] injecting password: " + str(format(context['password'], '020'))) | ||
| state.cpu.write_bytes(state.cpu.RDI,str(format(context['password'],'020'))) |
There was a problem hiding this comment.
The format function returns a string so we don't need to use str. Also, since we use the value twice, can we assign it to a variable? e.g. formatted_pwd = f"{context['password']:020}"?
bugsbunnyctf2017-rev150/solve.py
Outdated
| return to the original point of injection. | ||
| """ | ||
| with m.locked_context() as context: | ||
| if (len(str(context['password'])) == 20): |
There was a problem hiding this comment.
| if (len(str(context['password'])) == 20): | |
| if len(str(context['password'])) == 20: |
No description provided.