2

I want to send input to a process which includes unprintable characters like "\x90". I when I try to send it like this: p.sendline(p64(0x414190)), my programm which prints it back, returns AA\x90. It took the "\x90" as a string, not as a byte. Can someone help me how to send raw bytes?

My program (vulnerable to format string, I dont need to be told):

#include <stdio.h>

int main() {
  char name[512];
  char passwd[512];

  printf("Enter your name: ");
  fgets(name, sizeof(name), stdin);
  printf(name);

  printf("Enter your password: ");
  fgets(passwd, sizeof(passwd), stdin);
  printf(passwd);

  exit(1);
}
BitFriends
  • 379
  • 5
  • 18

2 Answers2

3

Using p64() does send the input as raw bytes. You can check it by adding pwntools' DEBUG flag while running your script. The debug output then prints everything that is sent and received. E.g.:

python2 solve.py DEBUG
[+] Starting local process './script': pid 23732
[DEBUG] Received 0x11 bytes:
    'Enter your name: '
[DEBUG] Sent 0x9 bytes:
    00000000  90 41 41 00  00 00 00 00  0a                        │·AA·│····│·│
    00000009
[*] Switching to interactive mode
[DEBUG] Received 0x18 bytes:
    00000000  90 41 41 45  6e 74 65 72  20 79 6f 75  72 20 70 61  │·AAE│nter│ you│r pa│
    00000010  73 73 77 6f  72 64 3a 20                            │sswo│rd: │
    00000018
\x90AAEnter your password: $

In the example above, you see that the bytes 90 41 41 00 00 00 00 00 0a are sent to the program, and not the string \x90.

maritio_o
  • 117
  • 10
  • And btw, I left out explaining why it is printed as the string `\x90` because I have no idea. I guess it is because 0x90 is a non-printable character. I cannot find it in the ASCII table, so maybe the hex value is printed to look good or something. – maritio_o Jun 02 '20 at 18:59
0

In fact the pwntools is exactly working as normal, the true problem is produced by python's grammar. If you only use print() to print the feedback, python will consider it as a 'string' but not 'byte'.

Rin777
  • 1