90 questions
2
votes
0
answers
89
views
Invert the stack with tmux, pwndbg, and splitmind?
I am using pwndbg, with tmux and splitmind. I have the layout the way I want, the only think I am trying to change is getting the stack pane to be inverted. Like what you would see when running 'stack ...
0
votes
0
answers
58
views
pwntools [Errno 24] Too many open files [-] Starting local process
I'm having an issue with some code I'm writing. I'm getting this pwntools error about too many files being open.
My code looks like.
for a in range(0,2**3360):
try:
with open(&...
- 576
0
votes
1
answer
2k
views
ModuleNotFoundError: No module named 'pwn' even though I installed pwntools with pipx, and already set PYTHONPATH
I'm working on arch linux.
I need the python module 'pwntools'.
First I did this:
pipx install pwntools
Then a warning:
Note: '/home/woc/.local/bin' is not on your PATH environment variable. These ...
- 3
0
votes
1
answer
175
views
How do I use recvline to read specific lines
I am connecting to a server, whereby the server will prompt me a question. To retrieve the question, I used recvline().strip().decode() to retrieve the line outputted. But it gets only the first line, ...
- 23
0
votes
1
answer
5k
views
ELF binary has inconsistency detected by ld.so: dl-call-libc-early-init.c: 37: Assertion `sym != NULL' failed [duplicate]
I'm encountering an issue while trying to run a binary file using both SPWN or Pwntools. Here's the context:
SPWN Logs:
[*] Binary: baskin
[*] Libc: libc-2.27.so
[*] Loader: ld-linux-x86-64.so.2
[*]...
- 67
0
votes
1
answer
100
views
Python Byte-encoding functions do not work as expected
I'm trying to convert a hexadecimal number,
like the stack address 0x7ffd6fa90940,
into its corresponding Byte representation b'\x40\x09\xa9\x6f\xfd\x7f\x00\x00'.
Just like how it is represented in ...
- 547
0
votes
1
answer
505
views
pwnlib.exception.PwnlibException: kernel architecture must be specified
Hi so I have a 32 bit little endian executable on Intel arch so I used context.binary for that and tried context.arch = vax to resolve this issue but both are not working what should I do?
Code below:
...
0
votes
1
answer
706
views
I am writing an exploit in PWN tools but i am getting this error "TypeError: can only concatenate str (not "bytes") to str"
I am trying to run the following exploit but i am getting the error mentioned above.
#!/usr/bin/env python
from pwn import *
sh = process('./ret2text')
target = 0x804863a
sh.sendline('A' * 108 + &...
- 1
0
votes
1
answer
3k
views
Receiving EOF while reading in interactive after executing /bin/sh
Im have been doing a course on writting pwntools based exploits. While trying a challenge, after all my attemps I recieve the error "Got EOF while reading in iteractive". My shellcode in ...
0
votes
1
answer
523
views
pwndbg crashed while hook debuging, after send the payload
OS: Arch Linux x86_64
This is my source code:
// gcc source.c -o vuln -no-pie -fno-stack-protector -z execstack -m32
#include <stdio.h>
void unsafe() {
char buffer[40];
puts("...
- 1
1
vote
1
answer
861
views
Installing pwntools from local repo
I have the pwntools-dev repo cloned to my machine. Using the instructions on the pwntools installation page, I am trying to install from this local repo, but am failing.
The command I am typing and ...
- 85
1
vote
0
answers
445
views
How to use Python pwn tools to resolve a side channel case study
I work on class exercice that involves on find a password on a remote server. The goal is to use the Python pwn library.
When I access to the server with a nc IP port I have :
[0000014075] ...
- 629
1
vote
1
answer
1k
views
How do I enable GDB/GEF to allow me to see how stack changes as I insert discrete input?
I am trying to identify the offset in which a buffer overflow occurs via pwntools and gdb. Here is the C code (x64):
int input[8];
int count, num;
count = 0;
while(1)
{
printf("Enter:\n&...
- 25
0
votes
0
answers
353
views
workaround for this module?
Im trying to install pwntools on OSX but theres a little bump in the installation process, for some reason, there is this module called "unicorn" that uses a setup.py which is deprecated, is ...
- 145
0
votes
2
answers
6k
views
Unable to install pwn package for python
I am trying to install the pwn library on my MacBook Air (M2, 2022) but it's failing while building the wheel for unicorn. I'm using python version 3.10.6.
This is the command I'm using: python3 -m ...
- 33
1
vote
1
answer
351
views
Remove bytes from list of bytestrings
I have this simple code:
from pwn import *
e = ELF(r'/home/user/Documents/pwnexercise')
print("Found hex:\n" + hex(e.symbols.main))
read_only_data = e.section('.rodata').split(b'\x00')
...
- 671
1
vote
1
answer
488
views
Why ret2shellcode fail in ubuntu 22.04 but success in ubuntu 18.04.5
I am learning ret2shellcode, and try it in ubuntu 22.04 and kali 2022.2, and fail to get shell, but in virtualbox, I host a ubuntu 18.04.5, and same pwn script , it success, so could anyone point ...
- 19
0
votes
1
answer
3k
views
Trying to run a buffer-overflow with Python/pwntools
I work on a online program in which I should do a buffer Overflow.
When I run the program, I have to complete a sum of two numbers generated randomly) :
>>> 451389913 + 1587598959 =
If I put ...
- 629
0
votes
1
answer
357
views
Create array with ROP chain (64-bit)?
in order to solve a binary exploitation CTF-Challenge I have to create an array of arguments to pass to a syscall. I searched a lot on the internet, but I can't find a description on how to create an ...
1
vote
1
answer
2k
views
how do i redirect fifo to stdin using python either with subprocess or with pwntools?
As an example I am trying to "imitate" the behaviour of the following sets of commands is bash:
mkfifo named_pipe
/challenge/embryoio_level103 < named_pipe &
cat > named_pipe
In ...
0
votes
1
answer
2k
views
Is there a way to convert memory adress string to little endian input?
this thing could easily be solves by writing a function that builds the string that I want.
But it would be a bit nicer, and a bit more concise if there is something that I can just import and use, it ...
- 733
2
votes
1
answer
3k
views
How to get the value from a variable with pwntools?
I'm using both pwntools and gdb to explore an ELF program and my question is how can I get the value of a variable like I do with "p <variable_name>" in gdb but in pwntools. I have ...
user15663059
1
vote
3
answers
1k
views
Why does the .bss segment have no executable attribute？
I have an ELF 32-bit executable file named orw from the pwnable.tw: https://pwnable.tw/challenge/. In my Ubuntu18.04, the .bss segment can be executed:
But in my Ubuntu20 and IDA Pro, the .bss ...
- 79
2
votes
1
answer
10k
views
Is there any way to use pwn tools to find the address of a function in an executable?
Let's say that I have a simple executable and I want to find the address of the main. Usually, I take the address from the objdump output, and then I use it in my pwn script. I want to make my script ...
- 620
-1
votes
1
answer
74
views
Execute Command in Binary String Format in Python3
I am retrieving simple assignment commands from a remote terminal connection in Python, and would like to execute them. The format will be like b = 3156, and I would like to execute it using exec(). ...
- 860