Skip to content

Instantly share code, notes, and snippets.

@circleous
Created May 14, 2021
Embed
What would you like to do?
ezpz.- HackToday 2018
#include <stdio.h>
#include <stdlib.h>
const char nothing_here[18] = "\x00/bin/true/bin/sh";
const _Bool true = 1;
int (*_printf)(const char*, ...) = &scanf;
int (*_memset)(FILE*, char*, int, size_t) = &setvbuf;
int (*_scanf)(const char*) = &puts;
int (*_strlen)(const char*) = &system;
void w_strlen (const char *str) { if (true) { __asm__("mov rax, rax\n\t"); _strlen(str); } }
void
__exit (void)
{
__asm__("mov rax, 5\n\t");
__asm__("call $+5\n\t");
__asm__("add [rsp], rax\n\t");
__asm__("ret\n\t");
char buf[16];
__asm__("jz $+4\n\t");
__asm__("jnz $+4\n\t");
__asm__(".byte 0xe8\n\t");
__asm__("ret\n\t");
_printf("%s", buf);
_scanf(buf);
}
int
main (int argc, char const *argv[])
{
__asm__("jz $+4\n\t");
__asm__("jnz $+4\n\t");
__asm__(".byte 0xe8\n\t");
__asm__("ret\n\t");
_memset(stdout, 0, 2, 0);
__asm__("mov rax, 5\n\t");
__asm__("call $+5\n\t");
__asm__("add [rsp], rax\n\t");
__asm__("ret\n\t");
_memset(stdin, 0, 2, 0);
__asm__("jz $+4\n\t");
__asm__("jnz $+4\n\t");
__asm__(".byte 0xe8\n\t");
__asm__("ret\n\t");
__exit();
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment