Right.
It's recording good.
So right now we have our necessary gadgets.
So we're going to go for our redo and we're going to add a buffer of 200 letter A's.
So B B, couple a times 200.
Let's see.
Let's put this right here.
Because to reach the canary, we needed 200 acres and then we have to repair our canary.
So for our buffer, instead of doing something like struct pack lowercase, I mean capital Q for double
long, the canary poem tools allows you to conveniently run this as buffer plus equals P 64 canary,
which packs the 64 bit little Indian.
Then you must overwrite and find your path to our IP using eight letter BS to reach our IP.
And then we pack our return instruction,
then pack our pop ready instructions.
This is basically a repeat of what we did before.
P 64 show buff equals plus p 64 CIS call plus equals 64 exit.
And then with open payload.
Right.
Binary.
That's payload.
Payload.
Right.
Finally, we send the buffer stuff.
And then it started to interact.
So make sure you memorize this format string attack the format stream bug.
These are not two ones.
These are two lowercase l's and x also come back from def con.
I'll go back into deeper detail about what's going on.
But at this point, we're ready to run our exploit.