0

I have a c exectuable that I want to exploit. The output of that file looks like this:

$ ./vuln_nostack 
Enter some text:
enteringTEXT
You entered: enteringTEXT

You enter some text, and the program spits it back.

I want to run this prorgam (and later exploit it) with python and pwntools.

So far, the functioning part of my pwntools program looks like this:

from concurrent.futures import process
from sys import stdout
from pwn import * 
import time


pty = process.PTY

p = process("./vuln_nostack", stdin=pty, stdout=pty)


ss = p.recv()
p.clean()
asstring = ss.decode("utf-8")

print(asstring)

This works fine, it gets the first line and then prints it.

What I want to do now is to send a message to the program and then get the final line.

I have tried something along these lines:

p.send(b"dong")

p.clean()

print(p.recv())

I'm not sure whether or not the send actually ever sends anything, but as soon as I add the recv function, the prorgam just hangs and never finishes.

My guess is that the input to the executable is never given properly, and therefore it's still just waiting.

How do I actually get a message delivered to the exectuable so that it can move on and srever me the last line?

Grazosi
  • 603
  • 1
  • 10

2 Answers2

1

You can also use p.sendline():

p.sendline("payload")

This automatically adds a breakline after your bytes.

Moreover, to know whether your exploit is sending/receiving messages to/from the program, you can use debug context by adding this assignment:

context.log_level = 'debug'
Non
  • 11
  • 4
0

The answer was a lot more simple than formerly presumed.

I just needed a breakline in the send:

p.send("payload \n")
Grazosi
  • 603
  • 1
  • 10