Best way to interact with a service for exploitati

问题:

Suppose I have a service to interact with. Using netcat it would be something like this:

> nc 127.0.0.1 8080
hello
hi how are you?

I want to automatize the interaction with this service in order to perform some attack e.g. format string. So I create a Python script and that was really painful to make it work. Here's the code:

    t = Telnet(HOST, PORT)
    t.write('2\n')
    for _ in xrange(10)): print(t.read_some())
    t.write('3\n')
    for _ in xrange(12)): print(t.read_some())

The problem here is the response from the service. The behavior I was expecting from this script was the following:

1. Send request for example "hello"
2. Get the response: "hi how are you?"

In this case the service is quite simple but suppose I have a service that prints a menu of options or a welcome screen, I had to read all this stuff and manually find the response to the command I sent (using the for _ in xrange ...).

To summarize: what's the best way to interact with such service by taking into account ONLY the response of an input command?

I don't know if python is right for this things. I tried using sockets but it was even worse than telnet because of the function recv

回答1:

Take a look into expect, which "talks" to interactive programs with the help of a user provided script.

Usage

expect ./interact

or making interact executable (chmod a+x interact):

./interact

where interact is the following script:

#!/usr/bin/expect
spawn nc 127.0.0.1 8080
send -- "hallo\r"
expect "hi how are you?\r"

This is just a simple example, the man page is full of in depth explanations and there are also example scripts which come with the installation.

References
* http://linuxaria.com/howto/2-practical-examples-of-expect-on-the-linux-cli?lang=en