Outils d'utilisateurs

Outils du Site


exploit_exercises_protostar:net0

Net 0

#include "../common/common.c"
 
#define NAME "net0"
#define UID 999
#define GID 999
#define PORT 2999
 
void run()
{
    unsigned int i;
    unsigned int wanted;
 
    wanted = random();
 
    printf("Please send '%d' as a little endian 32bit int\n", wanted);
 
    if(fread(&i, sizeof(i), 1, stdin) == NULL) {
        errx(1, ":(\n");
    }
 
    if(i == wanted) {
        printf("Thank you sir/madam\n");
    } else {
        printf("I'm sorry, you sent %d instead\n", i);
    }
}
 
int main(int argc, char **argv, char **envp)
{
    int fd;
    char *username;
 
    /* Run the process as a daemon */
    background_process(NAME, UID, GID);  
 
    /* Wait for socket activity and return */
    fd = serve_forever(PORT);
 
    /* Set the client socket to STDIN, STDOUT, and STDERR */
    set_io(fd);
 
    /* Don't do this :> */
    srandom(time(NULL));
 
    run();
}

Le programme génère un nombre aléatoire qu'il faut lui renvoyer en little endian 32 bit int. Si vous voulez en savoir plus sur ce format, je ne peux que vous conseiller de lire l'article de wikipedia. http://fr.wikipedia.org/wiki/Endianness

#!/usr/bin/env python
# encoding: utf-8
 
import telnetlib
from struct import pack
 
HOST = "192.168.1.29"
PORT = 2999
 
t = telnetlib.Telnet(HOST, PORT)
 
t.read_until("Please send '")
nbr = t.read_some()
nbr = int(nbr.split("'")[0])
print "Number : %d" % nbr
print "Send : %s" % (repr(pack('<I', nbr)))
 
t.write("%s\n" % pack('<I', nbr))
t.read_until("\n")
print t.read_some()
 
t.close()
exploit_exercises_protostar/net0.txt · Dernière modification: 2017/04/09 15:33 (modification externe)