guyinatuxedo/nightmare

tu17_vulnchat shell crashes after first command

mnemo9 opened this issue · 1 comments

$ python ./exploit.py
[+] Starting local process './vuln-chat': pid 1791438
  print(target.recvuntil("username: "))
  b'----------- Welcome to vuln-chat -------------\nEnter your username: '
    print(target.recvuntil("I know I can trust you?"))
    b"Welcome 00000000000000000000%99s!\nConnecting to 'djinn'\n--- 'djinn' has joined your chat ---\ndjinn: I have the information. But how do I know I can trust you?"
    [*] Switching to interactive mode

    00000000000000000000%99s: djinn: Sorry. That's not good enough
    flag{g0ttem_b0yz}
    Use it wisely
    [*] Got EOF while reading in interactive
    $ ps
    [*] Process './vuln-chat' stopped with exit code -11 (SIGSEGV) (pid 1791438)
    [*] Got EOF while sending in interactive
    Traceback (most recent call last):
      File "/usr/lib/python3.10/site-packages/pwnlib/tubes/process.py", line 746, in close
          fd.close()
          BrokenPipeError: [Errno 32] Broken pipe 

x86_64
python 3.10.2 --- I used 2to3 and/or bytes() to re/write the exploits for python3
pwntools 4.7.0

also nothing is mentioned in the tutorial as to what actually spawns this shell since printFlag() is certainly not doing it. please let us know

same with tamu19_pwn3/pwn3

$ python exploit.py
[+] Starting local process './pwn3': pid 1887926
  print(target.recvuntil("journey "))
b'Take this, you might need it on your journey '
[*] Switching to interactive mode
[*] Got EOF while reading in interactive
$                  <--- hit ENTER
[*] Process './pwn3' stopped with exit code -11 (SIGSEGV) (pid 1887926)
[*] Got EOF while sending in interactive
Traceback (most recent call last):
  File "/usr/lib/python3.10/site-packages/pwnlib/tubes/process.py", line 746, in close
    fd.close()
BrokenPipeError: [Errno 32] Broken pipe