cato447/ctf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

changed repo structure

Browse Source
This commit is contained in:
cato447
2025-06-06 02:50:04 +02:00
parent e887de976a
commit 6e6ee357b8
8848 changed files with 2089898 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
2024/insomnihack/pwn/promis/notes.md Normal file
View File

@@ -0,0 +1,13 @@
Plan:
1. Manipulate stack position to store libc address
2. Transform address to point to one-gadget
3. possibly zero rcx
4. overwrite saved rip with one-gadget
one-gadget for libc version at offset:
0x4f29e execve("/bin/sh", rsp+0x40, environ)
constraints:
address rsp+0x50 is writable
rsp & 0xf == 0
rcx == NULL || {rcx, "-c", r12, NULL} is a valid argv