diff options
Diffstat (limited to 'checker/src/checker.py')
| -rw-r--r-- | checker/src/checker.py | 36 |
1 files changed, 26 insertions, 10 deletions
diff --git a/checker/src/checker.py b/checker/src/checker.py index 633a0f1..fe2b8d5 100644 --- a/checker/src/checker.py +++ b/checker/src/checker.py @@ -28,6 +28,11 @@ endsolid test\xff generic_alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmopqrstuvwxyz0123456789-+.!" +script_path = os.path.dirname(os.path.realpath(__file__)) +models_path = f"{script_path}/models" +extra_models = [f"{models_path}/{path}" for path in \ + os.listdir(models_path) if path.endswith(".stl")] + def ensure_bytes(v): if type(v) == bytes: return v @@ -64,7 +69,7 @@ def approx_equal(f1, f2, precision = 2): def reverse_hash(hashstr): if type(hashstr) is bytes: hashstr = hashstr.decode() - data = subprocess.check_output([os.getenv("REVHASH_PATH"), hashstr])[:-1] + data = subprocess.check_output([f"{script_path}/revhash/revhash", hashstr])[:-1] if data == b"": raise BrokenServiceException(f"Failed to find hash preimage of {hashstr}") return data @@ -104,7 +109,7 @@ class STLDoctorChecker(BaseChecker): flag_variants = 2 noise_variants = 2 - havoc_variants = 16 + havoc_variants = 17 exploit_variants = 2 prompt = b"\r$ " @@ -298,9 +303,8 @@ class STLDoctorChecker(BaseChecker): conn.write(stlfile) # Check for errors - _ = conn.recvline() # Modelname: - line = conn.recvline() - if b"ERR:" in line: + resp = conn.recvline() + conn.recvline() + if b"ERR:" in resp: if check: raise BrokenServiceException(f"Failed to upload model {modelname}:\n{line}") conn.recvuntil(self.prompt) @@ -308,7 +312,7 @@ class STLDoctorChecker(BaseChecker): # Parse ID try: - modelid = line.rsplit(b"!", 1)[0].split(b"with ID ", 1)[1] + modelid = resp.rsplit(b"!", 1)[0].split(b"with ID ", 1)[1] if modelid == b"": raise Exception except: raise BrokenServiceException(f"Invalid response during upload of {modelname}:\n{line}") @@ -633,6 +637,19 @@ class STLDoctorChecker(BaseChecker): self.test_list(False) elif self.variant_id == 15: self.test_list(True) + elif self.variant_id == 16: + if len(extra_models) == 0: + return + # upload spicy models + conn = self.openconn() + model = rand.choice(extra_models) + modelname = os.path.basename(model).split("-")[0] + modelname += "".join([rand.choice("0123456789") for i in range(5)]) + stlfile = open(model, "rb").read() + self.debug(stlfile) + modelid = self.do_upload(conn, modelname, stlfile) + self.check_in_search(conn, modelname, [modelname, modelid, stlfile], download = True) + self.closeconn(conn) else: raise EnoException(f"Invalid havoc variant ({self.variant_id}) provided") @@ -680,11 +697,11 @@ class STLDoctorChecker(BaseChecker): raise BrokenServiceException("Exploit did not set 'loggedin' variable via overflow") # Get private user hashes via 'list' - resp = self.do_list(conn) + resp = self.do_list(conn, check=False) + if not resp: + raise BrokenServiceException("") self.debug("List response: " + str(resp)) users = [l.split(b" .")[1] for l in resp.split(b"\n") if b">> ." in l] - if len(users) == 0: - raise BrokenServiceException("Unable to list private user hashes") self.closeconn(conn) # Login as each private user @@ -706,7 +723,6 @@ class STLDoctorChecker(BaseChecker): # List all private files of user resp = self.do_list(conn) - self.closeconn(conn) # Search for flag in solid names names = b"\n".join([l.split(b": ", 1)[1] for l in resp.split(b"\n") if b"Solid Name: " in l]) |