1

On the tutorial by Megabeets, "A journey into Radare 2 – Part 2: Exploitation", he shows an example of how to create a payload with Python2

# Initial payload
payload  =  "A"*140 # padding
ropchain =  p32(puts_plt)
ropchain += p32(entry_point)
ropchain += p32(puts_got)

payload = payload + ropchain

How would that get ported to Python3? p32 is a 32bit integer. Python3 uses bytes() instead of strings. What's the right way to do this?

python3-pwntools's docs show that there are some payload helpers. But, I couldn't get them to work. Worse yet, those helpers were available in Python2 as well, but not used (not sure why).

How would I write Megabeet's example using python3-pwntools?

1
  • Thank you was looking for 1-2 hours about this. usually I do all my stuff on ruby/C/GO but was following an example that uses pwntools so was ignorant about this b'a'*100 etc switch was trying with str() but broke pwntools Apr 5, 2020 at 16:54

1 Answer 1

2

Actually, this is a programming question and not an RE question. Anyway, you simply need to tell python to treat your payload as bytes by adding the bytes-literal b before the 'A'*140.

>>> from pwn import *
>>>
>>> puts_plt = 0x8048390
>>> puts_got = 0x804a014
>>> entry_point = 0x80483d0
>>>
>>> payload  =  b'A' * 40   # Only 40 for the example
>>> ropchain =  p32(puts_plt)
>>> ropchain += p32(entry_point)
>>> ropchain += p32(puts_got)
>>>
>>> payload = payload + ropchain
>>>
>>> print(payload)
b'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x90\x83\x04\x08\xd0\x83\x04\x08\x14\xa0\x04\x08'
>>>

For further reading, you can read the String and Bytes literals page in the Python3 documentation.

1
  • I tried this but it didn't work with your script, so I was wondering if there was more to it in python3 as I'm fairly certain I got the variables at the top correct (see this for follow up reverseengineering.stackexchange.com/q/19784/22669). I wasn't sure if it was as simple as using the bit literals, or if I was supposed to use the payload formatter in pwntools. Nov 1, 2018 at 17:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.