62 lines
1.4 KiB
Python
Executable File
62 lines
1.4 KiB
Python
Executable File
#! /usr/bin/env python3
|
|
|
|
from pwn import *
|
|
|
|
ADD = 0
|
|
ADDI = 1
|
|
SUB = 2
|
|
COPY = 3
|
|
LOADI = 4
|
|
|
|
A = 0
|
|
B = 1
|
|
C = 2
|
|
D = 3
|
|
E = 4
|
|
F = 5
|
|
G = 6
|
|
H = 7
|
|
I = 8
|
|
J = 9
|
|
K = 10
|
|
L = 11
|
|
M = 12
|
|
N = 13
|
|
|
|
INSTR_LEN = 8
|
|
|
|
|
|
def instr_i(opcode, reg1, imm: int):
|
|
assert (opcode == ADDI or opcode == LOADI)
|
|
return bytes([opcode, reg1, 0, 0]) + imm.to_bytes(4, byteorder='little')
|
|
|
|
|
|
def instr_r(opcode, reg1, reg2):
|
|
assert (opcode == ADD or opcode == SUB or opcode == COPY)
|
|
return bytes([opcode, reg1, 0, 0, reg2, 0, 0, 0])
|
|
|
|
context.log_level = 'debug'
|
|
with remote("localhost", 1337, fam="ipv4") as p:
|
|
p.recvuntil(b"Password: ")
|
|
p.sendline(b"1234")
|
|
|
|
program = instr_i(LOADI, A, 0x50)
|
|
|
|
print(p.recvuntil(b"COPaaS - Compiler-oriented programming as a service\n").decode())
|
|
print(p.recvuntil(b"? (y/N):").decode())
|
|
p.sendline(b"N")
|
|
print(p.recvuntil(b"Using the demo version!").decode())
|
|
print(p.recvuntil(b"should it bee?").decode())
|
|
len_msg = str(len(program) // INSTR_LEN).encode()
|
|
log.info(f"Sending: {len_msg}")
|
|
p.sendline(len_msg)
|
|
print(p.recvuntil(b"Now your program:").decode())
|
|
log.info(f"Sending program: {list(program)}")
|
|
pause()
|
|
p.send(program)
|
|
p.interactive()
|
|
print(p.recvuntil(b"Your program exited with "))
|
|
exit_code = int(p.recvuntil(b"!", drop=True))
|
|
log.info(f"Retrieved exit code {exit_code}!")
|
|
p.interactive()
|