[x1rx]

Let's discuss the pwn challenge

[macavitysworld]

Let's discuss the pwn challenge

I haven't completed the exploit part, but this should lead you; Leak heap → leak libc → off-by-one overwrite → brute-force stack alignment → return to libc → get the flag.

[Axura]

http://4xura.com/wp-content/uploads/2024...bf_all.jpg

These hints should be enough to show you the path finishing the exploit part. Enjoy

[macavitysworld]

http://4xura.com/wp-content/uploads/2024...bf_all.jpg

These hints should be enough to show you the path finishing the exploit part. Enjoy

My instance always gets fcked up! lol

[x1rx]

1 - heap leak
2 - libc leak
3 - rbp leak
4 - stack pivot --> new rbp with off by null
5 - rop chain
6 - hijack execution flow


All steps are done and I got the flag(while loop) but my script is unstable . When I use off by null and pivoting on stack , process crashes .

What am I missing? any hint

[liruokemx]

exp.py

Hidden Content

You must register or login to view this content.

[NoobMaster669]

this is a good initiative will like to see this 
will appreciate if got it free