ctf-pwn

Crates.ioctf-pwn
lib.rsctf-pwn
version0.3.8
sourcesrc
created_at2022-11-01 18:13:44.759968
updated_at2024-05-06 23:41:14.34877
descriptionPwn utilities for Rust.
homepagehttps://github.com/rust-ctf/ctf-pwn
repositoryhttps://github.com/rust-ctf/ctf-pwn
max_upload_size
id702970
size127,028
(JPaja)

documentation

README

ctf-pwn

crate

Pwn utilities for Rust.

Features

Pipe

  • Converting TCP Stream or Process to Pipe
  • Conditional reading
  • Bridging pipe to stdout/stdin
  • Payload crafter
  • Ansi event support for ncurses like shells

Shell

  • Intel x86
  • Amd x64
  • Arm
  • Risc-V

Binary Parsing

  • Elf
  • PE

Examples

Connecting to tcp stream

let mut pipe = TcpPipe::connect("127.0.0.1:1337").await?;

Spawning new process

let mut pipe = ProcessPipe::from_app("ls").await?;

let mut pipe = ProcessPipe::from_app_args("ls", ["-l", "-a"]).await?;

Generic loading

let mut pipe = Pipe::new(stdin(), stdout());

Reading examples

let data: Vec<u8> = pipe.recv().await?;
let data: Vec<u8> = pipe.recv_until("Name:", false).await?;
let data: Vec<u8> = pipe.recv_until([0x01, 0x02, 0x03], false).await?;
let data: String = pipe.recv_line_utf8().await?;
let data: AsciiString = pipe.recv_line_ascii().await?;

Regex

let data = pipe.recv_until(r"(Ok)|(Error)", true).await?;
let flag = pipe.recv_regex_utf8(r"HTB\{[^\}]+\}").await?;

Interactive shell

pipe.interactive_shell().await?;

Ncurses support

Sending ansi commands

pipe.write_ansi_command(ansi::Down).await?;
pipe.write_ansi_command(ansi::Right).await?;
pipe.write_ansi_command(ansi::Enter).await?;

Ansi event based interactive shell

pipe.interactive_ansi().await?;

Payload

let payload = Payload::builder()
    .recv_until("> ", false)
    .push("1")
    .push("\n")
    .send()
    .recv_until("Insert card's serial number: ", false)
    .push_line("%4919x%7$hn")
    .send()
    .recv_regex_utf8(r"HTB\{[^\}]+\}")
    .build();

let flag = pipe.payload(payload).await?;
println!("{flag}");

Elf

let elf = Elf::parse("app_path").await?;
let got: &HashMap<String, u64> = elf.got();
let plt: &HashMap<String, u64> = elf.plt();
let symbols: &HashMap<String, Symbol> = elf.symbols();
let dynamic_symbols: &HashMap<String, Symbol> = elf.dynamic_symbols();
Commit count: 92

cargo fmt