Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- [+] Context = {'edi': 0, 'eax': 0, 'edx': 0, 'ebx': 0, 'esi': 0, 'ecx': 0}
- [+] Target = {'edi': edi, 'eax': eax, 'edx': 51, 'ebx': ebx, 'esi': esi, 'ecx': ecx}
- [+] Following gadgets available:
- -> add eax, 0x1 ; ret
- -> add eax, 0x32 ; ret
- -> add eax, 0x45 ; ret
- -> mov edx, ecx ; ret
- -> mov ecx, eax ; ret
- 1) Then, use the "add eax, 0x1 ; ret" gadget 1 times
- 2) Then, use the "add eax, 0x32 ; ret" gadget 1 times
- 3) Then, use the "mov edx, ecx ; ret" gadget 1 times
- 4) Then, use the "mov ecx, eax ; ret" gadget 1 times
- [+] Payload:
- from struct import pack
- p = ''
- p += pack('<I', 0x403a0e) # add eax, 0x1 ; ret
- p += pack('<I', 0x401207) # add eax, 0x32 ; ret
- p += pack('<I', 0x441ba7) # mov edx, ecx ; ret
- p += pack('<I', 0x441ba7) # mov ecx, eax ; ret
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement