Gallopsled / Gallopsled/pwntools

UDP recv works in Python console, does not work when executed as python3 exploit.py

Open
#1,976 5 comments 0 reactions 0 assignees View on GitHub
backport-required bug mystery term
Dominant language
Python
Stars
13.7k
Forks
1.9k
Avg merge
6d 23h
Merged PRs (30d)
3

Description

The following issue was reproducible on the latest Docker image, on macOS and in Kali.

```
from pwn import *
context.log_level = 'debug'
l = listen(typ='udp')
r = udp('localhost', l.lport)
r.send(b'test')
l.recv(timeout=4)
```

If this script is started inside python shell, all is good, l.recv receives hello.

```
Python 3.9.2 (default, Feb 28 2021, 17:03:44)
[GCC 10.2.1 20210110] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from pwn import *
>>> context.log_level = 'debug'
>>> l = listen(typ='udp')
[x] Trying to bind to :: on port 0
[x] Trying to bind to :: on port 0: Trying ::
[+] Trying to bind to :: on port 0: Done
[x] Waiting for connections on :::34099
>>> r = udp('localhost', l.lport)
[x] Opening connection to localhost on port 34099
[x] Opening connection to localhost on port 34099: Trying ::1
[+] Opening connection to localhost on port 34099: Done
>>> r.send(b'test')
[DEBUG] Sent 0x4 bytes:
b'test'
>>> l.recv(timeout=4)[+] Waiting for connections on :::34099: Got connection from ::1 on port 40984

b'test'
>>>
```

But once the code is saved as a python file and run with python3 exploit.py, l.recv is not receiving anything.

```
[+] Trying to bind to :: on port 0: Done
[+] Waiting for connections on :::55214: Got connection from ::1 on port 35994
[+] Opening connection to localhost on port 55214: Done
[DEBUG] Sent 0x4 bytes:
b'test'
[*] Closed connection to localhost port 55214
[*] Closed connection to ::1 port 35994
```

strace of the incorrect run
```
write(1, "[\33[1m\33[31mDEBUG\33[m] Sent 0x4 byt"..., 39[DEBUG] Sent 0x4 bytes:
) = 39
getpWaiting for connections on :::36419: Got connection from ::1 on port 48863
[+] e(1, " b'test'\33[K\n", 15 b'test'
) = 15
poll([{fd=5, events=POLLOUT}], 1, 1048576000) = 1 ([{fd=5, revents=POLLOUT}])
) = 4
ioctl(1, TCGETS, {B38400 opost isig -icanon -echo ...}) = 0
ioctl(1, TCGETS, {B38400 opost isig -icanon -echo ...}) = 0
ioctl(1, SNDCTL_TMR_STOP or TCSETSW, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, TCGETS, {B38400 opost isig icanon echo ...}) = 0
close(5) = 0
getpid() = 65307
write(1, "\33[?12l\33[?25h\33[?1l\33> \10[\33[1m\33[34m*"..., 82[*] Closed connection to localhost port 36419
) = 82
close(4) = 0
getpid() = 65307
write(1, "[\33[1m\33[34m*\33[m] Closed connectio"..., 55[*] Closed connection to ::1 port 48863
) = 55
lseek(3, 0, SEEK_CUR) = 0
rt_sigaction(SIGINT, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f26f1931140}, {sa_handler=0x6402c0, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f26f1931140}, 8) = 0
rt_sigaction(SIGCONT, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f26f1931140}, {sa_handler=0x6402c0, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f26f1931140}, 8) = 0
rt_sigaction(SIGTSTP, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f26f1931140}, {sa_handler=0x6402c0, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f26f1931140}, 8) = 0
rt_sigaction(SIGWINCH, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f26f1931140}, {sa_handler=0x6402c0, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f26f1931140}, 8) = 0
lseek(3, 0, SEEK_CUR) = 0
lseek(3, 0, SEEK_CUR) = 0
close(3) = 0

```

Contributor guide

Open the contributing guide

Research direction

Start by tracing the listen(typ='udp'), udp('localhost', l.lport), and l.recv(timeout=4) entry points and compare their behavior in an interactive console and a standalone script. Reproduce the provided example, then verify that the standalone script receives b'test' without changing the example's expected UDP behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.