I've been working my way through a security games site, trying to automate what I'm doing using pwntools. I've come across a problem somewhere in my process, however. When I try to run the vulnerable program on the server with my exploit string, it gets changed somewhere between the Python 2.7 script on my machine, and being returned back to me.
My general process for this particular challenge is as follows:
- Initiate SSH connection
- Open a shell through the SSH connection, I've tried "/bin/bash", "/bin/sh"
- Wait until I get the prompt
- Send the command in the format "%s %s" % (program_on_server, payload_string)
My payload string is the bytes "\x74\x84\x04\x08" repeated many times. The problem I'm having is that when the server echoes back what I've sent to the running shell, this is transformed into "\x74\x84\x07\x08\x1b\x5b\x4b". After some troubleshooting, I can't figure out where the extra bytes are coming from, or why the \x04 is getting turned into \x07. Pwntools seems to think it's sending the right bytes, the debug output shows the correct ones at least, so I am thinking the problem is somewhere server side in the chain from ssh to bash to the vulnerable program. Hence, posting it here and not somewhere more related to pwntools. Does anybody have any insight what might be causing this and why it's doing it?
The following is my code, with functions where the login information would go.
#!/usr/bin/python2 from pwn import * context.log_level = 'debug' def makePayloadString(): return p32(0x8048474)* 20 # p32 takes a 32 bit number and converts it to bytes sshConnection = ssh(user=getUser(), host=getHost(), password=getPassword()) command = "%s %s" % (getProgramLocation(), makePayloadString()) shell = sshConnection.shell("/bin/bash") shell.recvuntil("$ ", timeout=10) shell.sendline(command) shell.recvline(timeout=10)