Pwntools

Shellcoding

from pwn import *

context.arch = 'amd64'
shellcode = asm("""
    mov rax, 60
    mov rdi, 42
    syscall
    """)

print(shellcode)

from pwn import *

context.arch = 'amd64'
shellcode = asm(shellcraft.cat("/flag"))
print(disasm(shellcode))

Boilerplate

#!/usr/bin/env python3

from pwn import *

# =========================
# Setup
# =========================

context.arch = 'amd64'
context.log_level = 'info'

elf = ELF('./chall', checksec=False)

# =========================
# Start
# =========================

# Local
p = process('./chall')

# Remote
# p = remote('host', 1337)

# GDB
# p = gdb.debug('./chall', '''
#     break main
#     continue
# ''')


# =========================
# Sending
# =========================

p.send(b'AAAA')
p.sendline(b'AAAA')

p.sendafter(b'> ', b'AAAA')
p.sendlineafter(b'> ', b'AAAA')


# =========================
# Receiving
# =========================

p.recv(10)
p.recvline()
p.recvuntil(b'> ')

# Receive everything
p.recvall()

# =========================
# Packing
# =========================

p64(0xdeadbeef)
p32(0xdeadbeef)

u64(b'AAAAAAA')
u32(b'AAAA')


# =========================
# Useful ELF addresses
# =========================

elf.sym['main']
elf.plt['puts']
elf.got['puts']

# Example:
# log.info(hex(elf.sym['main']))
# log.info(hex(elf.plt['puts']))
# log.info(hex(elf.got['puts']))


# =========================
# Cyclic pattern
# =========================

pattern = cyclic(100)

# Find offset from crashed value:
# cyclic_find(0x6161616c)


# =========================
# ROP
# =========================

rop = ROP(elf)

# Find a gadget:
# pop_rdi = rop.find_gadget(['pop rdi', 'ret'])[0]
# ret = rop.find_gadget(['ret'])[0]

# offset = 72
#
# payload = flat(
#     b'A' * offset,
#     ret,
#     pop_rdi,
#     elf.got['puts'],
#     elf.plt['puts'],
#     elf.sym['main']
# )
#
# p.sendline(payload)

p.interactive()