Advertisement
zzqq0103

Untitled

Dec 1st, 2024
76
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.35 KB | None | 0 0
  1. #define _GNU_SOURCE
  2.  
  3. #include <endian.h>
  4. #include <stdint.h>
  5. #include <stdio.h>
  6. #include <stdlib.h>
  7. #include <string.h>
  8. #include <sys/syscall.h>
  9. #include <sys/types.h>
  10. #include <unistd.h>
  11.  
  12. uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0x0};
  13.  
  14. int main(void)
  15. {
  16. syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  17. intptr_t res = 0;
  18. res = syscall(__NR_socket, 0x10, 3, 0);
  19. if (res != -1)
  20. r[0] = res;
  21. res = syscall(__NR_socket, 0x11, 0x800000003, 0);
  22. if (res != -1)
  23. r[1] = res;
  24. *(uint16_t*)0x20000080 = 0x11;
  25. memcpy((void*)0x20000082,
  26. "\x00\x00\x01\x00\x00\x00\x00\x00\x08\x00\x44\x94\x4e\xeb\xa7\x1a\x49"
  27. "\x76\xe2\x52\x92\x2c\xb1\x8f\x6e\x2e\x2a\xba\x00\x00\x00\x01\x2e\x0b"
  28. "\x38\x36\x00\x54\x04\xb0\xe0\x30\x1a\x4c\xe8\x75\xf2\xe3\xff\x5f\x16"
  29. "\x3e\xe3\x40\xb7\x67\x95\x00\x80\x00\x00\x00\x00\x00\x00\x01\x01\x01"
  30. "\x3c\x58\x11\x03\x9e\x15\x77\x50\x27\xec\xce\x66\xfd\x79\x2b\xbf\x0e"
  31. "\x5b\xf5\xff\x1b\x08\x16\xf3\xf6\xdb\x1c\x00\x01\x00\x00\x00\x00\x00"
  32. "\x00\x00\x49\x74\x00\x00\x00\x00\x00\x00\x00\x06\xad\x8e\x5e\xcc\x32"
  33. "\x6d\x3a\x09\xff\xc2\xc6\x54",
  34. 126);
  35. syscall(__NR_bind, r[1], 0x20000080, 0x80);
  36. *(uint32_t*)0x20000140 = 0x14;
  37. res = syscall(__NR_getsockname, r[1], 0x20000040, 0x20000140);
  38. if (res != -1)
  39. r[2] = *(uint32_t*)0x20000044;
  40. *(uint64_t*)0x20000280 = 0;
  41. *(uint32_t*)0x20000288 = 0;
  42. *(uint64_t*)0x20000290 = 0x20000080;
  43. *(uint64_t*)0x20000080 = 0x200000c0;
  44. *(uint32_t*)0x200000c0 = 0x3c;
  45. *(uint16_t*)0x200000c4 = 0x24;
  46. *(uint16_t*)0x200000c6 = 0xf01;
  47. *(uint32_t*)0x200000c8 = 0xfffffffe;
  48. *(uint32_t*)0x200000cc = 0;
  49. *(uint8_t*)0x200000d0 = 0;
  50. *(uint32_t*)0x200000d4 = r[2];
  51. *(uint16_t*)0x200000d8 = 0;
  52. *(uint16_t*)0x200000da = 0;
  53. *(uint16_t*)0x200000dc = -1;
  54. *(uint16_t*)0x200000de = -1;
  55. *(uint16_t*)0x200000e0 = 0;
  56. *(uint16_t*)0x200000e2 = 0;
  57. *(uint16_t*)0x200000e4 = 0xb;
  58. *(uint16_t*)0x200000e6 = 1;
  59. memcpy((void*)0x200000e8, "dsmark\000", 7);
  60. *(uint16_t*)0x200000f0 = 0xc;
  61. *(uint16_t*)0x200000f2 = 2;
  62. *(uint16_t*)0x200000f4 = 8;
  63. *(uint16_t*)0x200000f6 = 2;
  64. *(uint16_t*)0x200000f8 = 2;
  65. *(uint64_t*)0x20000088 = 0x3c;
  66. *(uint64_t*)0x20000298 = 1;
  67. *(uint64_t*)0x200002a0 = 0;
  68. *(uint64_t*)0x200002a8 = 0;
  69. *(uint32_t*)0x200002b0 = 0;
  70. syscall(__NR_sendmsg, r[0], 0x20000280, 0);
  71. return 0;
  72. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement