forked from skalvin/Upload
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathexploit.py
48 lines (37 loc) · 1.43 KB
/
exploit.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
#!/usr/bin/python3
# Depends on pwntools. In kali, install via:
# sudo apt install python3-pwntools
# Configure: change the IP address passed to the remote function.
# Run: python3 exploit.py
# Library
from pwn import *
# Enable debug so that all received data is printed.
context.log_level = 'debug'
# Open connection to a remote process.
r = remote('83.136.255.205', 41685)
# When prompted, enter 'y'.
r.recvuntil(b'Are you ready? (y/n) ')
r.sendline(b'y')
# Function that will map a scenario to STOP, DROP or ROLL
def mapit(scenario):
if scenario == b'GORGE':
return b'STOP'
if scenario == b'PHREAK':
return b'DROP'
if scenario == b'FIRE':
return b'ROLL'
# Keep looping for ever. Alternatively, we could have explicitly looped until the flag is received
while True:
# Keep reading lines until a line is received containing at least one of GORGE, PHREAK or FIRE
scenarios = r.recvline_contains(('GORGE','PHREAK','FIRE'))
log.debug(f"scenarios: {scenarios}")
# Keeep reading bytes until the given prompt.
r.recvuntil(b'What do you do? ')
# Split the received scenarios by comma.
items = scenarios.split(b', ')
# Map each scenario to one of STOP, DROP or ROLL
instructions = map(mapit, items)
# Join the instructions together, separated by a dash
response = b'-'.join(instructions)
# Send the response
r.sendline(response)