solved Promis

2024-04-27 03:02:04 +02:00
parent 4584aff2a5
commit f167e20cd4
4 changed files with 43 additions and 0 deletions
--- a/insomnihack24/pwn/promis/notes.md
+++ b/insomnihack24/pwn/promis/notes.md
@@ -0,0 +1,13 @@
+Plan:
+
+1. Manipulate stack position to store libc address
+2. Transform address to point to one-gadget
+3. possibly zero rcx
+4. overwrite saved rip with one-gadget
+
+one-gadget for libc version at offset:
+0x4f29e execve("/bin/sh", rsp+0x40, environ)
+constraints:
+address rsp+0x50 is writable
+rsp & 0xf == 0
+rcx == NULL || {rcx, "-c", r12, NULL} is a valid argv