3
votes
Accepted
Buffer overflow: pwntools does not give me a shell, despite exploit working without pwntools
If you change your process startup to
p = process(["strace", "-o", "strace.out", "./bof"])
and check the resulting strace.out file, you will see:
close(0) ...
- 156
3
votes
Can I decompile a file if I have a compiler?
No. In most cases, you cannot obtain the actual source code just because you have the compiler available.
However, it depends on the language. If the source code was written in .NET, for example, a ...
- 233
3
votes
Receiving "Got EOF while reading in interactive" after properly executing system("/bin/sh") using pwntools
I think you might have an alignment problem. Find the address of a ret-only gadget and try putting it in your second payload as follows:
ret = p64(0x?????)
payload = junk + ret + pop_rdi + sh_addr + ...
- 31
2
votes
pwntools shellcode narnia2
This is a relatively old question, but I recently stumbled across the same problem myself. In the interest of the greater good, I will explain what is going on.
It is likely that the structure of your ...
- 121
2
votes
Accepted
What is the right way to pack a payload with Python3's pwntools
Actually, this is a programming question and not an RE question. Anyway, you simply need to tell python to treat your payload as bytes by adding the bytes-literal b before the 'A'*140.
>>> ...
- 8,899
1
vote
Accepted
ret2libc: problem getting exploit work without pwntools
It seems that I made two critical mistakes when I tried to use myfile.txt to exploit the binary.
When writing the exploit to the file I did NOT append \n to the payload. P.sendline() appends this to ...
- 33
1
vote
Accepted
Pwntools shows, "Got EOF while reading in interactive"?
Alright. So the issue here was I think that Radare was addressing libc based on a version on disk. And, the version in memory was different.
Anyway, I restarted the computer and redid the offset math ...
- 1,769
Only top scored, non community-wiki answers of a minimum length are eligible